Ulas 44d1b88e3d fix: resolve iOS forbidden errors by delivering CSRF token in response body ...

iOS Safari (especially PWA/standalone mode) unreliably exposes cookies
via document.cookie, causing CSRF token mismatch on state-changing
requests. The CSRF token is now included in /auth/login and /auth/me
response bodies and stored in-memory on the client. Cookie remains as
fallback. Retry mechanism also improved to read token from response
body and handle expired sessions.

2026-04-14 18:53:42 +02:00

..

middleware

fix: resolve iOS PWA session/CSRF issues causing forbidden errors

2026-04-14 17:37:22 +02:00

routes

fix: restore weather widget position - display directly below greeting banner

2026-04-14 08:52:00 +02:00

services

fix: timezone-aware CalDAV sync and English as i18n fallback (#43)

2026-04-13 09:20:27 +02:00

auth.js

fix: resolve iOS forbidden errors by delivering CSRF token in response body

2026-04-14 18:53:42 +02:00

db-schema-test.js

fix(imports): convert require() to ESM import for randomBytes in auth.js

2026-04-03 23:00:38 +02:00

db.js

feat(meals): add optional recipe link to meal cards (#18)

2026-04-05 18:03:05 +02:00

index.js

fix: default TRUST_PROXY to 1 for Docker+reverse-proxy setups (#46)

2026-04-14 09:04:06 +02:00

logger.js

fix(imports): convert require() to ESM import for randomBytes in auth.js

2026-04-03 23:00:38 +02:00