@devopsplaybook.io/common-web 0.9.0-beta.17.623b2b7 → 0.10.0-beta.18.afa437b

package/CHANGELOG.md

@@ -5,6 +5,55 @@ All notable changes to this project are documented here.
 This project follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 and [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.0] - 2026-11-01
+
+### Added
+
+- `registerAxiosAuthInterceptors(instance, { allowedOrigins, loginPaths })`:
+  `allowedOrigins` lists extra origins that may receive the bearer token, and
+  `loginPaths` replaces the default `/users/session` login-path exemption.
+- `AUTH_RENEWAL_FAILED` event with `{ reason }` (`timeout`, `5xx`, `network` or
+  `invalid-response`), carrying no token or PII. No OpenTelemetry metric or
+  dependency is added.
+- `UserService.isInitialized({ timeoutMs, signal, cacheTtlMs })`: a 5 s default
+  timeout, an optional `AbortSignal`, an opt-in short-lived cache for a
+  successful result and a logged failure reason.
+- `handleError(error, { debug })`: `debug: true` logs the raw error object; the
+  default logs a sanitized summary with redacted credentials.
+- `removeToken(token)` compare-and-remove semantics.
+
+### Changed
+
+- Bearer-token attachment is origin-scoped: relative URLs, the page origin, the
+  origin of an absolute `SERVER_URL` and configured `allowedOrigins` receive
+  the token; every other origin receives none and cannot trigger renewal.
+- A `401` clears the session only when the failed request used the currently
+  stored token; a stale `401` is ignored.
+- Session renewal runs in the background: `getToken()` and `getAuthHeader()`
+  return the still-valid token immediately while renewal continues. The
+  renewal timeout drops from 10 s to 3 s; one 500 ms retry and the 30 s cooldown
+  are unchanged.
+- `Config.set()` trims whitespace and strips trailing slashes and warns in
+  development about insecure non-loopback `http:` URLs.
+- `removeToken()`'s optional argument is no longer ignored, and
+  `AuthenticationStore` unsubscribes its `AUTH_UPDATED` listener when disposed.
+
+### Fixed
+
+- H1: bearer tokens are no longer attached to requests to third-party origins.
+- M1: a stale `401` no longer clears a newer session.
+- M2: error logging no longer includes the bearer token.
+- M6: `UserService.isInitialized()` no longer stalls on a hung backend and
+  reports the failure reason.
+- M10: session renewal no longer blocks the triggering request.
+- L2: an expired token is never returned after a slow renewal failure.
+- L4: the authentication store no longer leaks an event listener per instance.
+- L10: `SERVER_URL` trailing-slash and insecure-HTTP handling is enforced.
+- L11: login-path detection is configurable.
+- L14: tokens with malformed `exp`/`iat` claims are treated as corrupt.
+
+No dependency changed in this release.
+
 ## [0.9.0] - 2026-11-01
 
 ### Added

package/README.md

@@ -37,8 +37,11 @@ required. The `playground/` directory demonstrates a consuming app.
 Identical `type` + `text` pairs are deduplicated and the queue keeps at most
 five messages, dropping the oldest first. Alert styles use the prefixed
 `.alert-message*` classes, so consumer stylesheets are not affected by the
-layer's global styles. `handleError(error)` logs the error and emits a
-corresponding error alert.
+layer's global styles. `handleError(error, { debug = false } = {})` logs a
+sanitized summary (message, status, method, path without query string, and
+headers with credentials redacted) and emits a corresponding error alert.
+`debug: true` logs the raw error object, which may contain credentials, and is
+intended for development only.
 
 `AppNavigation` renders plain `<a href>` links by default, which keeps
 non-Nuxt deep imports and raw-source usage working. Nuxt applications should
@@ -91,29 +94,40 @@ The canonical auth storage key is `auth_token`. During this compatibility
 release, `AUTH_TOKEN` and `AUTH_TOKEN_KEY` are read and migrated to the
 canonical key. Tokens remain in `localStorage`, matching existing applications.
 When an authenticated token has entered the final 20% of its lifetime,
-`AuthService` renews it through `POST /api/users/session/refresh` before
-returning it from `getToken()` or `getAuthHeader()`. This extends active
-sessions without requiring users to sign in again.
+`AuthService` renews it through `POST /api/users/session/refresh` in the
+background. `getToken()` and `getAuthHeader()` return the still-valid current
+token immediately and the next call sees the renewed token, so a slow refresh
+endpoint never stalls a caller.
 
 `getToken()` never rejects because of the stored or renewed token:
 
 - A corrupt or undecodable token is treated as signed out: every auth key is
   removed, `AUTH_UPDATED` is emitted and `null` is returned. Expired tokens are
-  removed and return `null`.
+  removed and return `null`. A present `exp` or `iat` claim must be a finite
+  number; tokens with string or otherwise malformed claims are corrupt.
 - A `401` or `403` from the refresh endpoint means the session was revoked:
   the session is cleared, `AUTH_UPDATED` is emitted and `null` is returned.
 - Timeouts and invalid renewal responses perform a single request. Network
   errors and `5xx` responses retry once after a 500 ms backoff.
 - When renewal still fails, the still-valid current token is returned and
-  further renewal attempts for that token are paused for 30 seconds, so a slow
-  or failing refresh endpoint is not retried on every authenticated call. The
-  worst case is about 20.5 seconds per call for network/`5xx` failures and
-  about 10 seconds for timeouts or invalid responses.
-- Renewal requests time out after 10 seconds and concurrent calls share a
-  single request. A token saved while a renewal is in flight wins over the
-  renewed value.
+  further renewal attempts for that token are paused for 30 seconds. Renewal
+  runs in the background, so the worst case is about 6.5 seconds of background
+  work (two 3 s attempts plus the 500 ms backoff) and never blocks the caller.
+  If the token expired during the attempt, the session is cleared and later
+  calls return `null`.
+- Renewal requests time out after 3 seconds and concurrent calls share a single
+  request. A token saved while a renewal is in flight wins over the renewed
+  value.
 - Renewed tokens are validated (decodable, non-empty, future `exp`, and
   `exp > iat` when `iat` is present) before they are persisted.
+- `AUTH_RENEWAL_FAILED` is emitted with `{ reason }`, where `reason` is one of
+  `timeout`, `5xx`, `network` or `invalid-response`. It carries no token, URL or
+  PII; consumers may instrument their own telemetry. This package adds no
+  OpenTelemetry metric or dependency.
+
+`removeToken()` clears every stored auth key. `removeToken(token)` is a
+compare-and-remove operation: it clears the session only when the stored token
+still equals `token`, so a stale response cannot discard a newer session.
 
 ## Authentication state and HTTP integration
 
@@ -140,13 +154,27 @@ export default defineNuxtPlugin(() => {
 });
 ```
 
-`registerAxiosAuthInterceptors(instance?)` attaches `Authorization: Bearer
-<token>` only when the request has no explicit `Authorization` header, and is
-idempotent per Axios instance (it returns `false` when already registered). It
-preserves an explicit header without renewing the token, and does not clear the
-session on a failed login to a path ending in `/users/session`; a `401` from
-any other endpoint (including `/users/session/refresh`) removes the stored token
-and emits `AUTH_UPDATED`.
+`registerAxiosAuthInterceptors(instance = axios, { allowedOrigins = [],
+loginPaths = ["/users/session"] } = {})` attaches `Authorization: Bearer
+<token>` only when the request has no explicit `Authorization` header and the
+effective target is allowed:
+
+- relative URLs, the page origin, the origin of an absolute `Config.SERVER_URL`
+  and any origin listed in `allowedOrigins` receive the token;
+- cross-origin requests to any other origin receive no token, do not trigger a
+  token renewal, and fail closed when an absolute URL cannot be parsed;
+- `allowedOrigins` entries are normalised to origins and an invalid entry
+  throws `TypeError`;
+- registration is idempotent per Axios instance and returns `false` when
+  already registered; options apply only on the first registration.
+
+A `401` clears the stored token only when the failed request used the currently
+stored token (the attached token is recorded on the request or parsed from the
+sent `Authorization` header). A stale `401` is ignored, and a `401` from a
+request that sent no token clears nothing. Login paths are configurable through
+`loginPaths`: suffix matches on the effective pathname, default
+`["/users/session"]`, replaced when configured, with empty entries ignored.
+`loginPaths: []` exempts no path.
 
 ### Server URL configuration
 
@@ -161,14 +189,24 @@ await Config.get(); // { SERVER_URL: "https://api.example.com" }
 Config.reset(); // back to "/api"
 ```
 
-A non-same-origin `SERVER_URL` receives the bearer token when the opt-in Axios
-integration is used, so it must use HTTPS and allow the application origin
-through CORS.
+`Config.set()` trims whitespace and removes trailing slashes, so
+`"https://api.example.com///"` and `"/api/"` become `"https://api.example.com"`
+and `"/api"`. In development it warns when the URL uses `http:` and is not a
+loopback host (`localhost`, `127.0.0.1`, `[::1]`). A non-same-origin
+`SERVER_URL` must use HTTPS and allow the application origin through CORS;
+cross-origin requests receive the bearer token only when that origin is the
+configured `SERVER_URL` origin or listed in `allowedOrigins`.
 
 ### Service fallbacks
 
-`UserService.isInitialized()` resolves `false` on network or HTTP errors
-instead of rejecting, so setup code can gate on it safely.
+`UserService.isInitialized({ timeoutMs = 5000, signal, cacheTtlMs = 0 } = {})`
+resolves `false` on network or HTTP errors instead of rejecting, so setup code
+can gate on it safely. Each request is bounded by `timeoutMs` (5 s by default)
+and accepts an optional `AbortSignal`. With `cacheTtlMs > 0` a successful
+`true` result is reused for that duration (keyed by URL); `false` is never
+cached and `cacheTtlMs: 0` disables the cache. Failures log a warning with a
+`reason` (`timeout`, `aborted`, `http-<status>` or `network`) and no URL, token
+or response body.
 `RefreshIntervalService.get()` falls back to `"10000"` when the stored value is
 missing or malformed; `set()` normalises valid non-negative integer strings
 (for example `"05000"` becomes `"5000"`) and throws `TypeError` otherwise.

package/composables/EventBus.ts

@@ -2,32 +2,141 @@ import mitt from "mitt";
 
 export type AlertType = "info" | "success" | "warning" | "error";
 
+export type AuthRenewalFailureReason =
+  | "timeout"
+  | "5xx"
+  | "network"
+  | "invalid-response";
+
 export interface AlertMessage {
   type?: AlertType;
   text: string;
   durationMs?: number;
 }
 
+export interface AuthRenewalFailedEvent {
+  reason: AuthRenewalFailureReason;
+}
+
+export interface HandleErrorOptions {
+  debug?: boolean;
+}
+
 // mitt's Emitter constraint requires string and symbol index signatures;
-// the explicit ALERT_MESSAGE/AUTH_UPDATED keys keep their payload typing.
+// the explicit ALERT_MESSAGE/AUTH_UPDATED/AUTH_RENEWAL_FAILED keys keep their
+// payload typing.
 interface AppEvents {
   [event: string]: unknown;
   [event: symbol]: unknown;
   ALERT_MESSAGE: AlertMessage;
   AUTH_UPDATED: void;
+  AUTH_RENEWAL_FAILED: AuthRenewalFailedEvent;
 }
 
 export const EventTypes = {
   ALERT_MESSAGE: "ALERT_MESSAGE",
   AUTH_UPDATED: "AUTH_UPDATED",
+  AUTH_RENEWAL_FAILED: "AUTH_RENEWAL_FAILED",
 } as const;
 
 export type EventType = (typeof EventTypes)[keyof typeof EventTypes];
 
 export const EventBus = mitt<AppEvents>();
 
-export function handleError(error: unknown): void {
-  console.error(error);
+const SENSITIVE_HEADER =
+  /authorization|proxy-authorization|cookie|set-cookie|x-api-key|token|secret|key|auth/i;
+const BEARER_VALUE = /Bearer\s+[A-Za-z0-9._~+/=-]+/gi;
+const JWT_VALUE =
+  /[A-Za-z0-9_+/-]{6,}\.[A-Za-z0-9_+/=-]{6,}\.[A-Za-z0-9_+/=-]{6,}/g;
+
+interface ErrorCandidate {
+  message?: unknown;
+  config?: {
+    url?: unknown;
+    method?: unknown;
+    headers?: unknown;
+  };
+  response?: {
+    status?: unknown;
+  };
+}
+
+function redactText(text: string): string {
+  return text
+    .replace(BEARER_VALUE, "Bearer [redacted]")
+    .replace(JWT_VALUE, "[redacted]");
+}
+
+function toPath(url: string): string {
+  try {
+    return new URL(url, "http://localhost").pathname;
+  } catch {
+    return url.split(/[?#]/, 1)[0] ?? url;
+  }
+}
+
+function toPlainHeaders(headers: unknown): Record<string, unknown> | null {
+  if (typeof headers !== "object" || headers === null) return null;
+  const candidate = headers as { toJSON?: () => unknown };
+  if (typeof candidate.toJSON === "function") {
+    const plain = candidate.toJSON();
+    return typeof plain === "object" && plain !== null
+      ? (plain as Record<string, unknown>)
+      : null;
+  }
+  return headers as Record<string, unknown>;
+}
+
+function sanitizeHeaders(
+  headers: unknown,
+): Record<string, string> | undefined {
+  const plain = toPlainHeaders(headers);
+  if (!plain) return undefined;
+  const sanitized: Record<string, string> = {};
+  for (const [name, value] of Object.entries(plain)) {
+    sanitized[name] = SENSITIVE_HEADER.test(name)
+      ? "[redacted]"
+      : String(value);
+  }
+  return sanitized;
+}
+
+function errorMessage(error: unknown, candidate: ErrorCandidate): string {
+  if (error instanceof Error) return error.message;
+  if (typeof candidate.message === "string") return candidate.message;
+  return String(error);
+}
+
+function sanitizeError(error: unknown): Record<string, unknown> {
+  const candidate =
+    typeof error === "object" && error !== null
+      ? (error as ErrorCandidate)
+      : {};
+  const summary: Record<string, unknown> = {
+    message: redactText(errorMessage(error, candidate)),
+  };
+
+  const status = candidate.response?.status;
+  if (typeof status === "number") summary.status = status;
+
+  const method = candidate.config?.method;
+  if (typeof method === "string") summary.method = method;
+
+  const url = candidate.config?.url;
+  if (typeof url === "string") summary.path = toPath(url);
+
+  const headers = sanitizeHeaders(candidate.config?.headers);
+  if (headers) summary.headers = headers;
+
+  return summary;
+}
+
+export function handleError(
+  error: unknown,
+  options: HandleErrorOptions = {},
+): void {
+  console.error(options.debug ? error : sanitizeError(error));
+
   let text = error instanceof Error ? error.message : String(error);
 
   if (typeof error === "object" && error !== null && "response" in error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devopsplaybook.io/common-web",
-  "version": "0.9.0-beta.17.623b2b7",
+  "version": "0.10.0-beta.18.afa437b",
   "description": "Shared Nuxt layer for DevOpsPlaybook web applications",
   "license": "ISC",
   "repository": {

package/services/AuthService.ts

@@ -1,13 +1,17 @@
 import axios from "axios";
 import { jwtDecode } from "jwt-decode";
-import { EventBus, EventTypes } from "../composables/EventBus";
+import {
+  EventBus,
+  EventTypes,
+  type AuthRenewalFailureReason,
+} from "../composables/EventBus";
 import Config from "./Config";
 import { Timeout } from "./Timeout";
 
 export const AUTH_TOKEN_KEY = "auth_token";
 const LEGACY_TOKEN_KEYS = ["AUTH_TOKEN", "AUTH_TOKEN_KEY"] as const;
 
-const RENEWAL_TIMEOUT_MS = 10_000;
+const RENEWAL_TIMEOUT_MS = 3_000;
 const RENEWAL_RETRY_DELAY_MS = 500;
 const RENEWAL_FAILURE_COOLDOWN_MS = 30_000;
 const RENEWAL_MAX_ATTEMPTS = 2;
@@ -25,12 +29,19 @@ export interface AuthHeaders {
 
 class SessionRenewalError extends Error {
   retryable: boolean;
+  reason: AuthRenewalFailureReason;
   status?: number;
 
-  constructor(message: string, retryable: boolean, status?: number) {
+  constructor(
+    message: string,
+    retryable: boolean,
+    reason: AuthRenewalFailureReason,
+    status?: number,
+  ) {
     super(message);
     this.name = "SessionRenewalError";
     this.retryable = retryable;
+    this.reason = reason;
     this.status = status;
   }
 }
@@ -56,12 +67,17 @@ export class AuthService {
   }
 
   /**
-   * Clears every stored token and emits `AUTH_UPDATED`. The optional argument
-   * is accepted for API compatibility with older callers and is ignored.
+   * Clears every stored token and emits `AUTH_UPDATED` once.
+   *
+   * Without an argument every auth key is removed. With a token, this is a
+   * compare-and-remove operation: the session is cleared only when the stored
+   * token still equals the argument, so a stale response cannot discard a
+   * newer session.
    */
-  static async removeToken(_token?: string): Promise<void> {
+  static async removeToken(token?: string): Promise<void> {
     const storage = AuthService.storage();
     if (!storage) return;
+    if (token !== undefined && AuthService.readToken() !== token) return;
     const keys = [AUTH_TOKEN_KEY, ...LEGACY_TOKEN_KEYS];
     const present = keys.filter((key) => storage.getItem(key) !== null);
     if (present.length === 0) return;
@@ -91,7 +107,11 @@ export class AuthService {
       decoded.exp > decoded.iat &&
       decoded.exp - now <= (decoded.exp - decoded.iat) * 0.2
     ) {
-      return AuthService.renewToken(token);
+      // Renew in the background: the caller keeps using the still-valid token
+      // and a later call picks up the renewed value. Expected failures are
+      // handled inside renewal, so this promise never rejects.
+      void AuthService.renewToken(token);
+      return token;
     }
 
     return token;
@@ -130,16 +150,38 @@ export class AuthService {
 
   private static tryDecode(token: string): AuthTokenClaims | null {
     try {
-      const decoded = jwtDecode<AuthTokenClaims>(token);
-      if (typeof decoded !== "object" || decoded === null) return null;
-      return decoded;
+      const decoded = jwtDecode<unknown>(token);
+      if (
+        typeof decoded !== "object" ||
+        decoded === null ||
+        Array.isArray(decoded)
+      ) {
+        return null;
+      }
+      const claims = decoded as Record<string, unknown>;
+      if (
+        "exp" in claims &&
+        (typeof claims.exp !== "number" || !Number.isFinite(claims.exp))
+      ) {
+        return null;
+      }
+      if (
+        "iat" in claims &&
+        (typeof claims.iat !== "number" || !Number.isFinite(claims.iat))
+      ) {
+        return null;
+      }
+      return {
+        exp: claims.exp as number | undefined,
+        iat: claims.iat as number | undefined,
+      };
     } catch {
       return null;
     }
   }
 
-  private static async clearSession(): Promise<void> {
-    await AuthService.removeToken();
+  private static async clearSession(token?: string): Promise<void> {
+    await AuthService.removeToken(token);
   }
 
   private static emitAuthUpdated(): void {
@@ -174,10 +216,9 @@ export class AuthService {
   private static async requestTokenRenewal(
     token: string,
   ): Promise<string | null> {
-    const config = await Config.get();
-
     for (let attempt = 1; attempt <= RENEWAL_MAX_ATTEMPTS; attempt += 1) {
       try {
+        const config = await Config.get();
         const renewedToken = await AuthService.requestRenewedToken(
           config.SERVER_URL,
           token,
@@ -194,19 +235,19 @@ export class AuthService {
         if (renewalError.status === 401 || renewalError.status === 403) {
           const storedToken = AuthService.readToken();
           if (storedToken !== token) return storedToken;
-          await AuthService.clearSession();
+          await AuthService.clearSession(token);
           return null;
         }
 
         if (!renewalError.retryable || attempt === RENEWAL_MAX_ATTEMPTS) {
-          return AuthService.handleRenewalFailure(token);
+          return AuthService.handleRenewalFailure(token, renewalError.reason);
         }
 
         await Timeout.wait(RENEWAL_RETRY_DELAY_MS);
       }
     }
 
-    return AuthService.handleRenewalFailure(token);
+    return AuthService.handleRenewalFailure(token, "network");
   }
 
   private static async requestRenewedToken(
@@ -230,6 +271,7 @@ export class AuthService {
       throw new SessionRenewalError(
         "Session renewal response did not include a token",
         false,
+        "invalid-response",
       );
     }
 
@@ -238,6 +280,7 @@ export class AuthService {
       throw new SessionRenewalError(
         "Session renewal returned an invalid token",
         false,
+        "invalid-response",
       );
     }
 
@@ -250,6 +293,7 @@ export class AuthService {
       throw new SessionRenewalError(
         "Session renewal returned a token without a valid expiry",
         false,
+        "invalid-response",
       );
     }
 
@@ -260,6 +304,7 @@ export class AuthService {
       throw new SessionRenewalError(
         "Session renewal returned a token with an inconsistent claim window",
         false,
+        "invalid-response",
       );
     }
 
@@ -282,29 +327,58 @@ export class AuthService {
       return new SessionRenewalError(
         "Session renewal was rejected",
         false,
+        "invalid-response",
         status,
       );
     }
 
     if (candidate?.code === "ECONNABORTED" || candidate?.code === "ETIMEDOUT") {
-      return new SessionRenewalError("Session renewal timed out", false, status);
+      return new SessionRenewalError(
+        "Session renewal timed out",
+        false,
+        "timeout",
+        status,
+      );
     }
 
     if (typeof status === "number") {
       return new SessionRenewalError(
         `Session renewal failed with status ${status}`,
         status >= 500,
+        status >= 500 ? "5xx" : "invalid-response",
         status,
       );
     }
 
-    return new SessionRenewalError("Session renewal failed", true, status);
+    return new SessionRenewalError(
+      "Session renewal failed",
+      true,
+      "network",
+      status,
+    );
   }
 
-  private static handleRenewalFailure(token: string): string | null {
+  private static async handleRenewalFailure(
+    token: string,
+    reason: AuthRenewalFailureReason,
+  ): Promise<string | null> {
     const storedToken = AuthService.readToken();
     if (storedToken !== token) return storedToken;
 
+    EventBus.emit(EventTypes.AUTH_RENEWAL_FAILED, { reason });
+
+    // A slow renewal can outlive the token it tried to refresh; never hand an
+    // expired token back to the caller.
+    const decoded = AuthService.tryDecode(token);
+    const expired =
+      !decoded ||
+      (typeof decoded.exp === "number" &&
+        decoded.exp <= Date.now() / 1000);
+    if (expired) {
+      await AuthService.removeToken(token);
+      return null;
+    }
+
     AuthService.renewalFailure = { token, at: Date.now() };
     return token;
   }

package/services/AxiosAuthInterceptor.ts

@@ -1,30 +1,162 @@
 import axios, { AxiosHeaders } from "axios";
-import type { AxiosInstance } from "axios";
+import type {
+  AxiosInstance,
+  InternalAxiosRequestConfig,
+  RawAxiosHeaders,
+} from "axios";
 import { AuthService } from "./AuthService";
+import Config from "./Config";
 
 const REGISTRATION_MARKER = Symbol.for("common-web.axios-auth");
+const TOKEN_CONTEXT = Symbol("common-web.axios-auth-token");
+
+const DEFAULT_LOGIN_PATHS = ["/users/session"];
+
+export interface AxiosAuthInterceptorOptions {
+  /** Extra origins (for example `https://analytics.example.com`) that may receive the token. */
+  allowedOrigins?: string[];
+  /** Path suffixes exempt from the 401 session clear (for example `/auth/login`). */
+  loginPaths?: string[];
+}
 
 type MarkedAxiosInstance = AxiosInstance & {
   [key: symbol]: unknown;
 };
 
-function isLoginRequest(url: unknown): boolean {
-  if (typeof url !== "string" || url.length === 0) return false;
+type TokenContextConfig = InternalAxiosRequestConfig & {
+  [TOKEN_CONTEXT]?: string;
+};
+
+function pageOrigin(): string | null {
+  if (typeof window === "undefined" || !window.location) return null;
+  const origin = window.location.origin;
+  return origin && origin !== "null" ? origin : null;
+}
+
+function absoluteOrigin(value: string): string | null {
   try {
-    const { pathname } = new URL(url, "http://localhost");
-    return pathname.replace(/\/+$/, "").endsWith("/users/session");
+    const url = new URL(value);
+    return url.origin === "null" ? null : url.origin;
+  } catch {
+    return null;
+  }
+}
+
+function normalizeOrigins(origins: string[]): Set<string> {
+  return new Set(
+    origins.map((entry) => {
+      try {
+        return new URL(entry).origin;
+      } catch {
+        throw new TypeError(`Invalid allowed origin: ${entry}`);
+      }
+    }),
+  );
+}
+
+function normalizeLoginPaths(paths: string[]): string[] {
+  return paths
+    .map((path) => {
+      try {
+        return new URL(path, "http://localhost").pathname.replace(/\/+$/, "");
+      } catch {
+        return path.replace(/[?#].*$/, "").replace(/\/+$/, "");
+      }
+    })
+    .filter((path) => path.length > 0);
+}
+
+function isAllowedTarget(
+  uri: string,
+  serverOrigin: string | null,
+  allowedOrigins: Set<string>,
+): boolean {
+  let url: URL;
+  try {
+    url = new URL(uri);
+  } catch {
+    if (!uri.startsWith("//")) {
+      // Relative URLs inherit the page origin, so they are always allowed.
+      return true;
+    }
+    const origin = pageOrigin();
+    if (!origin) return false;
+    try {
+      url = new URL(uri, origin);
+    } catch {
+      return false;
+    }
+  }
+
+  if (url.origin === "null") return false;
+  if (url.origin === pageOrigin()) return true;
+  if (serverOrigin !== null && url.origin === serverOrigin) return true;
+  return allowedOrigins.has(url.origin);
+}
+
+function effectiveUri(
+  instance: AxiosInstance,
+  config: InternalAxiosRequestConfig,
+): string {
+  try {
+    return instance.getUri(config);
+  } catch {
+    // Axios rejects some special-scheme URLs while building the full path;
+    // fall back to the raw target so the origin check can still fail closed.
+    return typeof config.url === "string" ? config.url : "";
+  }
+}
+
+function isLoginRequest(
+  instance: AxiosInstance,
+  config: InternalAxiosRequestConfig,
+  loginPaths: string[],
+): boolean {
+  let uri: string;
+  try {
+    uri = instance.getUri(config);
+  } catch {
+    return false;
+  }
+
+  let pathname: string;
+  try {
+    pathname = new URL(uri, "http://localhost").pathname.replace(/\/+$/, "");
   } catch {
     return false;
   }
+
+  return loginPaths.some(
+    (loginPath) => pathname === loginPath || pathname.endsWith(loginPath),
+  );
+}
+
+function sentBearerToken(headers: unknown): string | null {
+  if (typeof headers !== "object" || headers === null) return null;
+  const parsed = AxiosHeaders.from(headers as RawAxiosHeaders);
+  const value = parsed.get("Authorization");
+  if (typeof value !== "string") return null;
+  const match = /^Bearer\s+(.+)$/i.exec(value.trim());
+  const token = match?.[1];
+  return token ? token.trim() : null;
 }
 
 export function registerAxiosAuthInterceptors(
   instance: AxiosInstance = axios,
+  options: AxiosAuthInterceptorOptions = {},
 ): boolean {
   const marked = instance as MarkedAxiosInstance;
   if (marked[REGISTRATION_MARKER]) {
     return false;
   }
+
+  // Validate options before marking the instance so a failed registration
+  // leaves it reusable.
+  const allowedOrigins = normalizeOrigins(options.allowedOrigins ?? []);
+  const loginPaths = normalizeLoginPaths(
+    options.loginPaths ?? DEFAULT_LOGIN_PATHS,
+  );
+
   marked[REGISTRATION_MARKER] = true;
 
   instance.interceptors.request.use(async (config) => {
@@ -33,10 +165,17 @@ export function registerAxiosAuthInterceptors(
       return config;
     }
 
+    const uri = effectiveUri(instance, config);
+    const { SERVER_URL } = await Config.get();
+    if (!isAllowedTarget(uri, absoluteOrigin(SERVER_URL), allowedOrigins)) {
+      return config;
+    }
+
     const token = await AuthService.getToken();
     if (token) {
       headers.set("Authorization", `Bearer ${token}`);
       config.headers = headers;
+      (config as TokenContextConfig)[TOKEN_CONTEXT] = token;
     }
     return config;
   });
@@ -44,8 +183,15 @@ export function registerAxiosAuthInterceptors(
   instance.interceptors.response.use(
     (response) => response,
     async (error) => {
-      if (error?.response?.status === 401 && !isLoginRequest(error?.config?.url)) {
-        await AuthService.removeToken();
+      if (
+        error?.response?.status === 401 &&
+        error?.config &&
+        !isLoginRequest(instance, error.config, loginPaths)
+      ) {
+        const config = error.config as TokenContextConfig;
+        const sentToken =
+          config[TOKEN_CONTEXT] ?? sentBearerToken(config.headers);
+        if (sentToken) await AuthService.removeToken(sentToken);
       }
       return Promise.reject(error);
     },

package/services/Config.ts

@@ -3,6 +3,28 @@ export interface AppConfig {
 }
 
 const DEFAULT_CONFIG: AppConfig = { SERVER_URL: "/api" };
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+
+function normalizeServerUrl(value: string): string {
+  return value.trim().replace(/\/+$/, "");
+}
+
+function warnAboutInsecureUrl(serverUrl: string): void {
+  const inDevelopment =
+    typeof process !== "undefined" && process.env.NODE_ENV !== "production";
+  if (!inDevelopment) return;
+
+  try {
+    const url = new URL(serverUrl);
+    if (url.protocol === "http:" && !LOOPBACK_HOSTS.has(url.hostname)) {
+      console.warn(
+        `[common-web] SERVER_URL uses insecure HTTP: ${url.origin}`,
+      );
+    }
+  } catch {
+    // Relative URLs inherit the page scheme and are not checked.
+  }
+}
 
 export default class Config {
   private static overrides: Partial<AppConfig> = {};
@@ -12,7 +34,12 @@ export default class Config {
   }
 
   static set(config: Partial<AppConfig>): void {
-    Config.overrides = { ...Config.overrides, ...config };
+    const next: Partial<AppConfig> = { ...config };
+    if (typeof config.SERVER_URL === "string") {
+      next.SERVER_URL = normalizeServerUrl(config.SERVER_URL);
+      warnAboutInsecureUrl(next.SERVER_URL);
+    }
+    Config.overrides = { ...Config.overrides, ...next };
   }
 
   static reset(): void {

package/services/UserService.ts

@@ -1,16 +1,82 @@
 import axios from "axios";
 import Config from "./Config";
 
+export interface UserInitializationOptions {
+  timeoutMs?: number;
+  signal?: AbortSignal;
+  cacheTtlMs?: number;
+}
+
+type InitializationFailureReason =
+  | "timeout"
+  | "aborted"
+  | "network"
+  | `http-${number}`;
+
+const DEFAULT_TIMEOUT_MS = 5_000;
+
 export class UserService {
-  static async isInitialized(): Promise<boolean> {
+  private static cache: { url: string; expiresAt: number } | null = null;
+
+  static async isInitialized(
+    options: UserInitializationOptions = {},
+  ): Promise<boolean> {
+    const cacheTtlMs = options.cacheTtlMs ?? 0;
     try {
       const config = await Config.get();
-      const response = await axios.get<{ initialized: boolean }>(
-        `${config.SERVER_URL}/users/status/initialization`,
-      );
-      return response.data.initialized === true;
-    } catch {
+      const url = `${config.SERVER_URL}/users/status/initialization`;
+
+      if (
+        cacheTtlMs > 0 &&
+        UserService.cache?.url === url &&
+        UserService.cache.expiresAt > Date.now()
+      ) {
+        return true;
+      }
+
+      const response = await axios.get<{ initialized: boolean }>(url, {
+        timeout: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        ...(options.signal ? { signal: options.signal } : {}),
+      });
+      const initialized = response.data.initialized === true;
+
+      if (initialized && cacheTtlMs > 0) {
+        UserService.cache = { url, expiresAt: Date.now() + cacheTtlMs };
+      }
+
+      return initialized;
+    } catch (error) {
+      console.warn("[common-web] user initialization check failed", {
+        reason: UserService.failureReason(error),
+      });
       return false;
     }
   }
+
+  private static failureReason(
+    error: unknown,
+  ): InitializationFailureReason {
+    const candidate = error as
+      | { code?: unknown; name?: unknown; response?: { status?: unknown } }
+      | null
+      | undefined;
+
+    if (
+      candidate?.code === "ECONNABORTED" ||
+      candidate?.code === "ETIMEDOUT"
+    ) {
+      return "timeout";
+    }
+    if (
+      candidate?.code === "ERR_CANCELED" ||
+      candidate?.name === "CanceledError"
+    ) {
+      return "aborted";
+    }
+
+    const status = candidate?.response?.status;
+    if (typeof status === "number") return `http-${status}`;
+
+    return "network";
+  }
 }

package/stores/AuthenticationStore.ts

@@ -1,5 +1,5 @@
 import { acceptHMRUpdate, defineStore } from "pinia";
-import { ref } from "vue";
+import { onScopeDispose, ref } from "vue";
 import { EventBus, EventTypes } from "../composables/EventBus";
 import { AUTH_TOKEN_KEY, AuthService } from "../services/AuthService";
 
@@ -29,8 +29,12 @@ export function createAuthenticationStore() {
     }
 
     if (typeof window !== "undefined") {
-      EventBus.on(EventTypes.AUTH_UPDATED, () => {
+      const handleAuthUpdated = () => {
         void refreshAuthentication();
+      };
+      EventBus.on(EventTypes.AUTH_UPDATED, handleAuthUpdated);
+      onScopeDispose(() => {
+        EventBus.off(EventTypes.AUTH_UPDATED, handleAuthUpdated);
       });
       registerStorageSync();
     }