@spidy092/auth-client 2.1.3 → 2.1.5

package/core.js

@@ -189,18 +189,22 @@ export function handleCallback() {
   if (accessToken) {
     setToken(accessToken);
     
-    // ✅ Refresh token should NOT be in URL - it's in httpOnly cookie
-    // If refresh token is in URL, log warning but don't store it client-side
+    // ✅ For HTTP development, store refresh token from URL
+    // In HTTPS production, refresh token is in httpOnly cookie (more secure)
     const refreshTokenInUrl = params.get('refresh_token');
     if (refreshTokenInUrl) {
-      console.warn('⚠️ SECURITY WARNING: Refresh token found in URL - this should not happen!');
-      // DO NOT store refresh token from URL - it should only be in httpOnly cookie
+      const isHttpDev = typeof window !== 'undefined' && window.location?.protocol === 'http:';
+      if (isHttpDev) {
+        console.log('📦 HTTP dev mode: Storing refresh token from callback URL');
+        setRefreshToken(refreshTokenInUrl);
+      } else {
+        console.log('🔒 HTTPS mode: Refresh token is in httpOnly cookie (ignoring URL param)');
+      }
     }
     
     const url = new URL(window.location);
     url.searchParams.delete('access_token');
     url.searchParams.delete('refresh_token');
-    url.searchParams.delete('refresh_token');
     url.searchParams.delete('state');
     url.searchParams.delete('error');
     url.searchParams.delete('error_description');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spidy092/auth-client",
-  "version": "2.1.3",
+  "version": "2.1.5",
   "description": "Scalable frontend auth SDK for centralized login using Keycloak + Auth Service.",
   "main": "index.js",
   "module": "index.js",