Rokojori cb2fba6e8b auth: Bearer-before-cookie token extraction; JWT_CLOCK_TOLERANCE for clock skew ... extractToken now checks Authorization: Bearer before the accessToken cookie so injected headers (Electron, API clients) cannot be shadowed by stale cookies. JWT_CLOCK_TOLERANCE env var (seconds) is passed to jwt.verify as clockTolerance when non-zero — set in .env for local dev to absorb clock skew vs production. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-07-18 08:37:26 +02:00
..
auth.ts	auth: Bearer-before-cookie token extraction; JWT_CLOCK_TOLERANCE for clock skew	2026-07-18 08:37:26 +02:00