Auth token is exposed to client-side scripts (security)

[KinshukSS2]

Summary

The access token was persisted in browser localStorage and also set as a non-HttpOnly cookie from client-side code, making it readable by injected JavaScript.

Evidence

• ui/context/AuthContext.tsx
  • Reads token from localStorage during init.
  • Stores token in localStorage when set.
  • Previously set token cookie from client with httpOnly: false.
• ui/features/auth/components/Login.tsx
  • Previously set token cookie from client with httpOnly: false.

Steps to Reproduce

1. Run app and log in.
2. Open browser DevTools console.
3. Execute: localStorage.getItem('token').
4. Observe token value is directly accessible to JavaScript.

Actual Result

Bearer token is accessible from browser script context.

Expected Result

Access/session tokens should not be directly readable by client-side JavaScript.

Impact

• High security exposure in presence of XSS.
• Increased risk of token exfiltration and account takeover.

Suspected Root Cause

Auth state and persistence were implemented fully client-side, and token cookie handling was intentionally configured as non-HttpOnly.

[KinshukSS2]

the current changes that I have done improves security by removing tokens from JS access and using HttpOnly sessions instead.
it is a quick fix to reduce risk for now
if needed I can follow up with a more complete auth redesign in a separate PR