Stronger account session security // NodeFlux News
The API now relies on HttpOnly sessions issued by the server and stricter ownership checks.
The API now relies on HttpOnly sessions issued by the server and stricter ownership checks.
NodeFlux no longer trusts login state stored only in the frontend when a user accesses protected API routes. The backend now identifies the current user from a session cookie issued by the server and verifies ownership for service, ticket, and profile actions.
The rollout also included stricter CORS, security headers, sanitized HTML rendering, password hashing, production sourcemap hardening, and safer logout behavior.