mbkauthe 5.0.4 → 5.1.0

package/docs/guides/configuration.md

@@ -35,7 +35,7 @@ This document describes the environment variables MBKAuth expects and keeps brie
   - Required: Yes
 
 - DOMAIN
-  - Description: App domain (e.g., `localhost` or `yourdomain.com`). Required when deployed.
+  - Description: Root app domain used for cross-subdomain cookie sharing in production (e.g., `yourdomain.com`, not `auth.yourdomain.com`). When `IS_DEPLOYED=true`, session cookies are scoped to `.yourdomain.com` so they are sent on all subdomains.
   - Example: `"DOMAIN":"localhost"`
   - Required: Yes
 
@@ -95,11 +95,6 @@ This document describes the environment variables MBKAuth expects and keeps brie
   - If `GOOGLE_LOGIN_ENABLED=true`, `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET` are required.
   - If `GITHUB_LOGIN_ENABLED=true`, GitHub App client credentials are required.
 
-- GITHUB_APP_SLUG
-  - Description: GitHub App slug (optional for login flow in this package; useful for install/link flows handled elsewhere).
-  - Required: No
-  - Create GitHub App: https://github.com/settings/apps
-
 - GITHUB_APP_CLIENT_ID / GITHUB_APP_CLIENT_SECRET
   - Description: GitHub App OAuth credentials used for user sign-in.
   - Required when `GITHUB_LOGIN_ENABLED=true`.

package/docs/guides/database.md

@@ -16,7 +16,7 @@ Postgres enum `role`: `SuperAdmin`, `NormalUser`, `Guest`, `member`. The script
 
 Core accounts table (`"Users"`): username, activation flag, role, mail flag, `AllowedApps` and `Positions` as JSONB, timestamps, optional `last_login`, and password hash column `PasswordEnc` (no plaintext passwords).
 
-Profile-style columns include `FullName`, `email`, `Image`, `Bio`, `SocialAccounts`, and password-reset fields (`resetToken`, `resetTokenExpires`, `resetAttempts`, `lastResetAttempt`).
+Profile-style columns include `FullName`, `UserId` (exactly 9 characters, unique business identifier assigned externally), `email`, `Image`, `Bio`, `SocialAccounts`, and password-reset fields (`resetToken`, `resetTokenExpires`, `resetAttempts`, `lastResetAttempt`).
 
 Indexes cover username, role, active, email, last login, and GIN indexes on JSONB for `AllowedApps` and `Positions`. The SQL file also adds optional covering indexes used on hot auth paths.
 

package/docs/schema/db.sql

@@ -17,13 +17,16 @@ CREATE TABLE IF NOT EXISTS "Users" (
     last_login timestamp with time zone,
     "PasswordEnc" character varying(255),
     "FullName" character varying(100),
+    "UserId" character varying(9),
     email text DEFAULT 'support@mbktech.org'::text,
     "Image" text DEFAULT 'https://portal.mbktech.org/icon.svg'::text,
     "Bio" text DEFAULT 'I am ....'::text,
     "SocialAccounts" text DEFAULT '{}'::text,
     "Positions" jsonb DEFAULT '{"Not_Permanent": "Member Is Not Permanent"}'::jsonb,
     CONSTRAINT "Users_pkey" PRIMARY KEY (id),
-    CONSTRAINT "Users_UserName_key" UNIQUE ("UserName")
+    CONSTRAINT "Users_UserName_key" UNIQUE ("UserName"),
+    CONSTRAINT "Users_UserId_key" UNIQUE ("UserId"),
+    CONSTRAINT chk_users_userid_length CHECK ("UserId" IS NULL OR length("UserId") = 9)
 );
 CREATE INDEX IF NOT EXISTS idx_users_active ON "Users" USING btree ("Active");
 CREATE INDEX IF NOT EXISTS idx_users_allowedapps_gin ON "Users" USING gin ("AllowedApps");
@@ -32,6 +35,7 @@ CREATE INDEX IF NOT EXISTS idx_users_last_login ON "Users" USING btree (last_log
 CREATE INDEX IF NOT EXISTS idx_users_positions_gin ON "Users" USING gin ("Positions");
 CREATE INDEX IF NOT EXISTS idx_users_role ON "Users" USING btree ("Role");
 CREATE INDEX IF NOT EXISTS idx_users_username_cover ON "Users" USING btree ("UserName") INCLUDE ("Active", "Role");
+CREATE INDEX IF NOT EXISTS idx_users_userid ON "Users" USING btree ("UserId");
 COMMENT ON TABLE "Users" IS '[core]';
 
 -- Table: ApiTokens
@@ -326,3 +330,20 @@ COMMENT ON TABLE "website_access_logs" IS '[core]';
 INSERT INTO "Users" ("UserName", "PasswordEnc", "Role", "Active", "HaveMailAccount", "FullName")
 VALUES ('support', 'b8b10c1c9006d8c30ab81c412463c65ff6dae3293d9bfbaf5fd8e275081d0947f000a828004e2fbd3a8f6ef5a35ae3eddd4c57b00ecab376b12e607a16a57459', 'SuperAdmin', true, false, 'Support User')
 ON CONFLICT ("UserName") DO NOTHING;
+
+-- Migration: add UserId to existing Users tables (idempotent)
+ALTER TABLE "Users" ADD COLUMN IF NOT EXISTS "UserId" character varying(9);
+
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1 FROM pg_constraint WHERE conname = 'Users_UserId_key'
+    ) THEN
+        ALTER TABLE "Users" ADD CONSTRAINT "Users_UserId_key" UNIQUE ("UserId");
+    END IF;
+END $$;
+
+ALTER TABLE "Users" DROP CONSTRAINT IF EXISTS chk_users_userid_length;
+ALTER TABLE "Users" ADD CONSTRAINT chk_users_userid_length CHECK ("UserId" IS NULL OR length("UserId") = 9);
+
+CREATE INDEX IF NOT EXISTS idx_users_userid ON "Users" USING btree ("UserId");

package/index.d.ts

@@ -19,7 +19,7 @@ declare global {
 
     interface Session {
       user?: {
-        id: number;
+        userId?: string;
         username: string;
         fullname?: string;
         role: 'SuperAdmin' | 'NormalUser' | 'Guest';
@@ -28,7 +28,7 @@ declare global {
         tokenScope?: 'read-only' | 'write' | null;
       };
       preAuthUser?: {
-        id: number;
+        userId?: string;
         username: string;
         role: 'SuperAdmin' | 'NormalUser' | 'Guest';
         loginMethod?: 'password' | 'github' | 'google';
@@ -55,7 +55,6 @@ declare module 'mbkauthe' {
     COOKIE_EXPIRE_TIME?: number;
     DEVICE_TRUST_DURATION_DAYS?: number;
     GITHUB_LOGIN_ENABLED?: 'true' | 'false' | 'f';
-    GITHUB_APP_SLUG?: string;
     GITHUB_APP_CLIENT_ID?: string;
     GITHUB_APP_CLIENT_SECRET?: string;
     GOOGLE_LOGIN_ENABLED?: 'true' | 'false' | 'f';
@@ -67,7 +66,6 @@ declare module 'mbkauthe' {
 
   export interface OAuthConfig {
     GITHUB_LOGIN_ENABLED?: 'true' | 'false' | 'f';
-    GITHUB_APP_SLUG?: string;
     GITHUB_APP_CLIENT_ID?: string;
     GITHUB_APP_CLIENT_SECRET?: string;
     GOOGLE_LOGIN_ENABLED?: 'true' | 'false' | 'f';
@@ -79,7 +77,7 @@ declare module 'mbkauthe' {
   export type UserRole = 'SuperAdmin' | 'NormalUser' | 'Guest';
 
   export interface SessionUser {
-    id: number;
+    userId?: string;
     username: string;
     fullname?: string;
     role: UserRole;
@@ -88,7 +86,7 @@ declare module 'mbkauthe' {
   }
 
   export interface PreAuthUser {
-    id: number;
+    userId?: string;
     username: string;
     role: UserRole;
     allowedApps?: string[];
@@ -100,6 +98,7 @@ declare module 'mbkauthe' {
   export interface DBUser {
     id: number;
     UserName: string;
+    UserId?: string;
     PasswordEnc?: string;
     Role: UserRole;
     Active: boolean;
@@ -300,6 +299,18 @@ declare module 'mbkauthe' {
     httpOnly: boolean;
   };
 
+  export function resolveCookieDomain(
+    isDeployed: 'true' | 'false' | 'f' | string,
+    domain?: string,
+    isTestDev?: boolean
+  ): string | undefined;
+
+  export function getCookieDomain(): string | undefined;
+
+  export function getCookieSecure(): boolean;
+
+  export function isAllowedOriginHostname(hostname: string, domain?: string): boolean;
+
   export function getClearCookieOptions(): {
     domain?: string;
     secure: boolean;
@@ -321,6 +332,8 @@ declare module 'mbkauthe' {
 
   export function hashPassword(password: string, username: string): string;
 
+  export function verifyPassword(password: string, username: string, storedHash: string): Promise<boolean>;
+
   export function clearSessionCookies(res: Response): void;
 
   export function getLatestVersion(): Promise<string>;

package/lib/config/cookies.js

@@ -6,7 +6,7 @@ const MAX_REMEMBERED_ACCOUNTS = 5;
 const ACCOUNT_LIST_COOKIE = 'mbkauthe_accounts';
 
 // Cookie security: encryption and signing
-const COOKIE_ENCRYPTION_KEY = mbkautheVar.SESSION_SECRET_KEY || 'fallback-secret-key-change-this';
+const COOKIE_ENCRYPTION_KEY = mbkautheVar.SESSION_SECRET_KEY;
 const ENCRYPTION_ALGORITHM = 'aes-256-gcm';
 
 // Derive encryption key from session secret
@@ -121,8 +121,7 @@ const decryptCookiePayload = (payload) => {
 // Generate fingerprint from user-agent only (salted)
 const generateFingerprint = (req) => {
     const userAgent = req.headers['user-agent'] || '';
-    // Use SESSION_SECRET_KEY as salt if available, otherwise fallback to encryption key
-    const salt = mbkautheVar.SESSION_SECRET_KEY || COOKIE_ENCRYPTION_KEY;
+    const salt = mbkautheVar.SESSION_SECRET_KEY;
 
     // Hash user-agent with salt to prevent rainbow table attacks on UAs
     return crypto
@@ -152,19 +151,41 @@ export const decryptSessionId = (encryptedSessionId) => {
     }
 };
 
+const isTestDevEnvironment = () => process.env.test === 'dev';
+
+export const resolveCookieDomain = (isDeployed, domain, isTestDev = isTestDevEnvironment()) => {
+    if (isDeployed !== 'true' || isTestDev || !domain) {
+        return undefined;
+    }
+
+    return `.${String(domain).replace(/^\.+/, '')}`;
+};
+
+export const getCookieDomain = () => resolveCookieDomain(mbkautheVar.IS_DEPLOYED, mbkautheVar.DOMAIN);
+
+export const getCookieSecure = () => mbkautheVar.IS_DEPLOYED === 'true' && !isTestDevEnvironment();
+
+export const isAllowedOriginHostname = (hostname, domain = mbkautheVar.DOMAIN) => {
+    if (!hostname || !domain) {
+        return false;
+    }
+
+    return hostname === domain || hostname.endsWith(`.${domain}`);
+};
+
 // Shared cookie options functions
 const getCookieOptions = () => ({
     maxAge: mbkautheVar.COOKIE_EXPIRE_TIME * 24 * 60 * 60 * 1000,
-    domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
-    secure: mbkautheVar.IS_DEPLOYED === 'true',
+    domain: getCookieDomain(),
+    secure: getCookieSecure(),
     sameSite: 'lax',
     path: '/',
     httpOnly: true
 });
 
 const getClearCookieOptions = () => ({
-    domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
-    secure: mbkautheVar.IS_DEPLOYED === 'true',
+    domain: getCookieDomain(),
+    secure: getCookieSecure(),
     sameSite: 'lax',
     path: '/',
     httpOnly: true
@@ -183,16 +204,20 @@ export const generateDeviceToken = () => {
     return crypto.randomBytes(32).toString('hex');
 };
 
+const getDeviceTokenKey = () => {
+    return crypto.createHash('sha256').update(`${mbkautheVar.SESSION_SECRET_KEY}:device-token`).digest();
+};
+
 // Hash a device token for safe storage in the database
 export const hashDeviceToken = (token) => {
     if (!token || typeof token !== 'string') return null;
-    return crypto.createHmac('sha256').update(token).digest('hex');
+    return crypto.createHmac('sha256', getDeviceTokenKey()).update(token).digest('hex');
 };
 
 export const getDeviceTokenCookieOptions = () => ({
     maxAge: DEVICE_TRUST_DURATION_MS,
-    domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
-    secure: mbkautheVar.IS_DEPLOYED === 'true',
+    domain: getCookieDomain(),
+    secure: getCookieSecure(),
     sameSite: 'lax',
     path: '/',
     httpOnly: true

package/lib/config/index.js

@@ -8,7 +8,7 @@ const logConfig = createLogger("config");
 const CONFIG_KEYS = [
     "APP_NAME", "DEVICE_TRUST_DURATION_DAYS", "Main_SECRET_TOKEN", "SESSION_SECRET_KEY",
     "IS_DEPLOYED", "LOGIN_DB", "MBKAUTH_TWO_FA_ENABLE", "COOKIE_EXPIRE_TIME", "DOMAIN", "loginRedirectURL",
-    "GITHUB_LOGIN_ENABLED", "GITHUB_APP_SLUG", "GITHUB_APP_CLIENT_ID", "GITHUB_APP_CLIENT_SECRET", "GITHUB_CLIENT_ID", "GITHUB_CLIENT_SECRET", "GOOGLE_LOGIN_ENABLED", "GOOGLE_CLIENT_ID",
+    "GITHUB_LOGIN_ENABLED", "GITHUB_APP_CLIENT_ID", "GITHUB_APP_CLIENT_SECRET", "GITHUB_CLIENT_ID", "GITHUB_CLIENT_SECRET", "GOOGLE_LOGIN_ENABLED", "GOOGLE_CLIENT_ID",
     "GOOGLE_CLIENT_SECRET", "MAX_SESSIONS_PER_USER"
 ];
 
@@ -26,7 +26,7 @@ const DEFAULT_CONFIG = {
 const BOOLEAN_KEYS = ['GITHUB_LOGIN_ENABLED', 'GOOGLE_LOGIN_ENABLED', 'MBKAUTH_TWO_FA_ENABLE', 'IS_DEPLOYED'];
 const STRING_KEYS = [
     "APP_NAME", "Main_SECRET_TOKEN", "SESSION_SECRET_KEY", "LOGIN_DB", "DOMAIN", "loginRedirectURL",
-    "GITHUB_APP_SLUG", "GITHUB_APP_CLIENT_ID", "GITHUB_APP_CLIENT_SECRET", "GITHUB_CLIENT_ID", "GITHUB_CLIENT_SECRET",
+    "GITHUB_APP_CLIENT_ID", "GITHUB_APP_CLIENT_SECRET", "GITHUB_CLIENT_ID", "GITHUB_CLIENT_SECRET",
     "GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"
 ];
 const REQUIRED_KEYS = ["APP_NAME", "Main_SECRET_TOKEN", "SESSION_SECRET_KEY", "IS_DEPLOYED", "LOGIN_DB",
@@ -253,6 +253,10 @@ try {
     }
 }
 
+import { setPasswordPepper } from "./security.js";
+
+setPasswordPepper(mbkautheVar.SESSION_SECRET_KEY);
+
 export { packageJson, appVersion, mbkautheVar };
-export { hashPassword, hashApiToken } from "./security.js";
+export { hashPassword, hashApiToken, verifyPassword } from "./security.js";
 export { TOKEN_SCOPES, DEFAULT_SCOPE, canAccessMethod, isValidScope, getAvailableScopes } from "./tokenScopes.js";

package/lib/config/security.js

@@ -1,15 +1,55 @@
 import crypto from "crypto";
+import { promisify } from "util";
 
-// Password hashing using PBKDF2
+const pbkdf2Async = promisify(crypto.pbkdf2);
+const PBKDF2_ITERATIONS = 100000;
+const PBKDF2_KEYLEN = 64;
+const PBKDF2_DIGEST = "sha512";
+
+let passwordPepper = null;
+
+export function setPasswordPepper(pepper) {
+  passwordPepper = pepper;
+}
+
+const getPasswordPepper = () => {
+  if (!passwordPepper) {
+    throw new Error("[mbkauthe] Password pepper not initialized");
+  }
+  return passwordPepper;
+};
+
+const getPasswordSalt = (username) => `${username}:${getPasswordPepper()}`;
+
+async function derivePasswordHash(password, username) {
+  const derived = await pbkdf2Async(password, getPasswordSalt(username), PBKDF2_ITERATIONS, PBKDF2_KEYLEN, PBKDF2_DIGEST);
+  return derived.toString("hex");
+}
+
+function derivePasswordHashSync(password, username) {
+  return crypto.pbkdf2Sync(password, getPasswordSalt(username), PBKDF2_ITERATIONS, PBKDF2_KEYLEN, PBKDF2_DIGEST).toString("hex");
+}
+
+function timingSafeHashEqual(stored, computed) {
+  const storedBuffer = Buffer.from(String(stored), "utf8");
+  const computedBuffer = Buffer.from(String(computed), "utf8");
+  return storedBuffer.length === computedBuffer.length && crypto.timingSafeEqual(storedBuffer, computedBuffer);
+}
+
+// Password hashing using PBKDF2 with username + application pepper as salt
 export const hashPassword = (password, username) => {
-    const salt = username;
-    // 128 characters returned
-    return crypto.pbkdf2Sync(password, salt, 100000, 64, 'sha512').toString('hex');
+  return derivePasswordHashSync(password, username);
+};
+
+export const verifyPassword = async (password, username, storedHash) => {
+  if (!password || !username || !storedHash) return false;
+
+  const computed = await derivePasswordHash(password, username);
+  return timingSafeHashEqual(storedHash, computed);
 };
 
 // Hash an API token for storage
-// Uses SHA-256 for fast, secure non-reversible hashing
 export const hashApiToken = (token) => {
-    if (!token) return null;
-    return crypto.createHash('sha256').update(token).digest('hex');
-};
+  if (!token) return null;
+  return crypto.createHash("sha256").update(token).digest("hex");
+};

package/lib/db/AuthRepository.js

@@ -18,8 +18,8 @@ export class AuthRepository extends BaseRepository {
     const fields = [
       `s.id as sid`,
       `s.expires_at`,
-      `u.id as uid`,
       `u."UserName"`,
+      `u."UserId"`,
       `u."Active"`,
       `u."Role"`,
       `u."AllowedApps"`
@@ -85,7 +85,7 @@ export class AuthRepository extends BaseRepository {
         AND td."ExpiresAt" > NOW()
         AND u."UserName" = td."UserName"
         AND u."Active" = TRUE
-      RETURNING td."UserName", td."ExpiresAt", u."id" as id, u."Active", u."Role", u."AllowedApps"
+      RETURNING td."UserName", td."ExpiresAt", u."UserId", u."Active", u."Role", u."AllowedApps"
     `;
 
     const result = await this.executeRaw({
@@ -168,12 +168,12 @@ export class AuthRepository extends BaseRepository {
     return result.rows?.[0] || null;
   }
 
-  async updateLastLoginReturnProfile(userId) {
-    const query = `UPDATE "Users" SET "last_login" = NOW() WHERE "id" = $1 RETURNING "FullName", "Image"`;
+  async updateLastLoginReturnProfile(username) {
+    const query = `UPDATE "Users" SET "last_login" = NOW() WHERE "UserName" = $1 RETURNING "FullName", "Image"`;
     const result = await this.executeRaw({
       name: "login-update-last-login-return-profile",
       text: query,
-      values: [userId]
+      values: [username]
     });
     return result.rows?.[0] || null;
   }
@@ -196,7 +196,7 @@ export class AuthRepository extends BaseRepository {
 
   async getUserWithTwoFA(username, queryName = "login-get-user") {
     const query = `
-      SELECT u.id, u."UserName", u."PasswordEnc", u."Active", u."Role", u."AllowedApps",
+      SELECT u."UserName", u."UserId", u."PasswordEnc", u."Active", u."Role", u."AllowedApps",
              tfa."TwoFAStatus", u."FullName", u."Image"
       FROM "Users" u
       LEFT JOIN "TwoFA" tfa ON u."UserName" = tfa."UserName"
@@ -222,7 +222,7 @@ export class AuthRepository extends BaseRepository {
 
   async getOAuthUserByProviderId(provider, providerId) {
     const { table, idColumn, queryName } = this.resolveOAuthProvider(provider);
-    const query = `SELECT ug.*, u."UserName", u."Role", u."Active", u."AllowedApps", u."id", tfa."TwoFAStatus"
+    const query = `SELECT ug.*, u."UserName", u."UserId", u."Role", u."Active", u."AllowedApps", tfa."TwoFAStatus"
                    FROM ${table} ug
                    JOIN "Users" u ON ug.user_name = u."UserName"
                    LEFT JOIN "TwoFA" tfa ON u."UserName" = tfa."UserName"
@@ -234,7 +234,7 @@ export class AuthRepository extends BaseRepository {
   async getApiTokenByHash(tokenHash, queryName = "validate-api-token") {
     const query = `
       SELECT t.id, t."UserName", t."ExpiresAt", t."Permissions",
-             u.id as uid, u."Active", u."Role", u."AllowedApps" as user_allowed_apps, u."FullName"
+             u."UserId", u."Active", u."Role", u."AllowedApps" as user_allowed_apps, u."FullName"
       FROM "ApiTokens" t
       JOIN "Users" u ON t."UserName" = u."UserName"
       WHERE t."TokenHash" = $1 LIMIT 1

package/lib/main.js

@@ -5,6 +5,7 @@ import passport from 'passport';
 import {
   sessionConfig,
   corsMiddleware,
+  securityHeadersMiddleware,
   sessionRestorationMiddleware,
   sessionCookieSyncMiddleware,
   requestContextMiddleware
@@ -39,6 +40,7 @@ router.use(express.urlencoded({ extended: true }));
 router.use(cookieParser());
 
 // CORS and security headers
+router.use(securityHeadersMiddleware);
 router.use(corsMiddleware);
 
 // Attach request context as early as possible so session-store queries are tied to the request.

package/lib/middleware/auth.js

@@ -110,7 +110,7 @@ async function validateTokenAuthentication(req) {
     updateApiTokenLastUsedThrottled(row.id);
 
     return {
-      id: row.uid,
+      userId: row.UserId || undefined,
       username: row.UserName,
       fullname: row.FullName,
       role: row.Role,
@@ -127,7 +127,7 @@ async function validateTokenAuthentication(req) {
 
 function attachApiTokenUser(req, res, tokenUser) {
   const user = {
-    id: tokenUser.id,
+    userId: tokenUser.userId,
     username: tokenUser.username,
     fullname: tokenUser.fullname,
     role: tokenUser.role,
@@ -398,7 +398,7 @@ async function validateApiSession(req, res, next) {
  * Returns: true if session refreshed and valid, false if session invalidated
  */
 async function reloadSessionUser(req, res) {
-  if (!req.session || !req.session.user || !req.session.user.id) return false;
+  if (!req.session || !req.session.user || !req.session.user.username) return false;
   try {
     const { sessionId: currentSessionId } = req.session.user;
 
@@ -447,6 +447,7 @@ async function reloadSessionUser(req, res) {
     req.session.user.username = row.UserName;
     req.session.user.role = row.Role;
     req.session.user.allowedApps = row.AllowedApps;
+    req.session.user.userId = row.UserId || undefined;
 
     // Obtain fullname from client cookie cache when present else DB
     if (typeof row.FullName === 'string' && row.FullName.trim() !== '') {

package/lib/middleware/index.js

@@ -3,8 +3,9 @@ import pgSession from "connect-pg-simple";
 const PgSession = pgSession(session);
 import { dblogin, runWithRequestContext } from "#pool.js";
 import { mbkautheVar } from "#config.js";
-import { cachedCookieOptions, decryptSessionId, encryptSessionId } from "#cookies.js";
+import { cachedCookieOptions, decryptSessionId, encryptSessionId, cachedClearCookieOptions, getCookieDomain, getCookieSecure, isAllowedOriginHostname } from "#cookies.js";
 import { AuthRepository } from "../db/AuthRepository.js";
+import { isUserAuthorizedForApp } from "../utils/appAccess.js";
 
 // Session configuration
 export const sessionConfig = {
@@ -24,10 +25,10 @@ export const sessionConfig = {
   cookie: {
     maxAge: mbkautheVar.COOKIE_EXPIRE_TIME * 24 * 60 * 60 * 1000,
     // Don't set domain in development/localhost to avoid cookie issues
-    domain: (mbkautheVar.IS_DEPLOYED === 'true' && process.env.test !== 'dev') ? `.${mbkautheVar.DOMAIN}` : undefined,
+    domain: getCookieDomain(),
     httpOnly: true,
     // Only use secure cookies in production with HTTPS
-    secure: mbkautheVar.IS_DEPLOYED === 'true' && process.env.test !== 'dev',
+    secure: getCookieSecure(),
     sameSite: 'lax',
     path: '/'
   },
@@ -37,16 +38,23 @@ export const sessionConfig = {
 const authRepo = new AuthRepository({ db: dblogin });
 const hasAuthorizationHeader = (req) => typeof req.headers?.authorization === 'string' && req.headers.authorization.trim().length > 0;
 
+export function securityHeadersMiddleware(req, res, next) {
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  res.setHeader("X-Frame-Options", "SAMEORIGIN");
+  res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
+  if (getCookieSecure()) {
+    res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+  }
+  next();
+}
+
 // CORS middleware
 export function corsMiddleware(req, res, next) {
   const origin = req.headers.origin;
   if (origin) {
     try {
       const originUrl = new URL(origin);
-      const allowedDomain = `.${mbkautheVar.DOMAIN}`;
-      // Exact match or subdomain match
-      if (originUrl.hostname === mbkautheVar.DOMAIN ||
-        (originUrl.hostname.endsWith(allowedDomain) && originUrl.hostname.charAt(originUrl.hostname.length - allowedDomain.length - 1) !== '.')) {
+      if (isAllowedOriginHostname(originUrl.hostname)) {
         res.header('Access-Control-Allow-Origin', origin);
         res.header('Access-Control-Allow-Credentials', 'true');
         res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE');
@@ -73,13 +81,7 @@ export async function sessionRestorationMiddleware(req, res, next) {
     // Early validation to avoid unnecessary processing (expect DB UUID id)
     if (!sessionId || typeof sessionId !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(sessionId)) {
       // Clear invalid cookie to prevent repeated attempts
-      res.clearCookie('sessionId', {
-        domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
-        path: '/',
-        httpOnly: true,
-        secure: mbkautheVar.IS_DEPLOYED === 'true',
-        sameSite: 'lax'
-      });
+      res.clearCookie('sessionId', cachedClearCookieOptions);
       return next();
     }
 
@@ -91,10 +93,12 @@ export async function sessionRestorationMiddleware(req, res, next) {
         // Reject expired sessions or inactive users
         if ((row.expires_at && new Date(row.expires_at) <= new Date()) || !row.Active) {
           // leave cookies cleared and don't restore session
+        } else if (!isUserAuthorizedForApp(row.Role, row.AllowedApps)) {
+          // Session exists but user is not authorized for this app
         } else {
           const normalizedSessionId = String(sessionId);
           req.session.user = {
-            id: row.uid,
+            userId: row.UserId || undefined,
             username: row.UserName,
             role: row.Role,
             sessionId: normalizedSessionId,

package/lib/routes/auth.js

@@ -1,5 +1,4 @@
 import express from "express";
-import crypto from "crypto";
 import csurf from "csurf";
 import speakeasy from "speakeasy";
 import rateLimit from 'express-rate-limit';
@@ -9,10 +8,10 @@ import {
   cachedCookieOptions, cachedClearCookieOptions, clearSessionCookies,
   generateDeviceToken, getDeviceTokenCookieOptions, DEVICE_TRUST_DURATION_MS, hashDeviceToken,
   upsertAccountListCookie, readAccountListFromCookie, removeAccountFromCookie, clearAccountListCookie,
-  encryptSessionId
+  encryptSessionId, getCookieDomain
 } from "#cookies.js";
 import { packageJson } from "#config.js";
-import { hashPassword } from "#config.js";
+import { hashPassword, verifyPassword } from "#config.js";
 import { ErrorCodes, createErrorResponse, logError } from "../utils/errors.js";
 import { AuthRepository } from "../db/AuthRepository.js";
 import { createLogger } from "../utils/logger.js";
@@ -109,7 +108,6 @@ export async function checkTrustedDevice(req, username) {
   try {
     // Hash the provided device token before querying DB (we store token hashes in DB)
     const deviceTokenHash = hashDeviceToken(deviceToken);
-    // Single round-trip: validate trusted device AND refresh LastUsed.
     const deviceUser = await authRepo.touchTrustedDevice(deviceTokenHash, username);
 
     if (deviceUser) {
@@ -129,7 +127,7 @@ export async function checkTrustedDevice(req, username) {
 
       logAuth(`Trusted device validated for user: ${username}`);
       return {
-        id: deviceUser.id,
+        userId: deviceUser.UserId || undefined,
         username: username,
         role: deviceUser.Role,
         allowedApps: deviceUser.AllowedApps,
@@ -205,13 +203,13 @@ export async function completeLoginProcess(req, res, user, redirectUrl = null, t
     // Update last_login and fetch FullName/Image in a single query.
     let profileRow = null;
     try {
-      profileRow = await authRepo.updateLastLoginReturnProfile(user.id);
+      profileRow = await authRepo.updateLastLoginReturnProfile(username);
     } catch (profileUpdateErr) {
       console.error(`[mbkauthe] Error updating last_login/returning profile:`, profileUpdateErr);
     }
 
     req.session.user = {
-      id: user.id,
+      userId: user.userId || user.UserId || undefined,
       username: username,
       role: user.role || user.Role,
       sessionId: dbSessionId,
@@ -311,7 +309,6 @@ export async function completeLoginProcess(req, res, user, redirectUrl = null, t
       const responsePayload = {
         success: true,
         message: "Login successful",
-        sessionId: dbSessionId,
       };
 
       if (redirectUrl) {
@@ -376,10 +373,7 @@ router.post("/api/login", LoginLimit, async (req, res) => {
     // Password verification (hash-only). We never read/compare plaintext passwords.
     let passwordMatches = false;
     if (user.PasswordEnc) {
-      const hashedInputPassword = hashPassword(password, user.UserName);
-      const stored = Buffer.from(String(user.PasswordEnc), 'utf8');
-      const computed = Buffer.from(String(hashedInputPassword), 'utf8');
-      passwordMatches = stored.length === computed.length && crypto.timingSafeEqual(stored, computed);
+      passwordMatches = await verifyPassword(password, user.UserName, user.PasswordEnc);
     }
 
     if (!passwordMatches) {
@@ -418,7 +412,7 @@ router.post("/api/login", LoginLimit, async (req, res) => {
       logAuth(`Trusted device login for user: ${trimmedUsername}, skipping 2FA only`);
 
       const userForSession = {
-        id: user.id,
+        userId: user.UserId || undefined,
         username: user.UserName,
         role: user.Role,
         allowedApps: user.AllowedApps,
@@ -431,7 +425,7 @@ router.post("/api/login", LoginLimit, async (req, res) => {
       // 2FA is enabled, prompt for token on a separate page
       const requestedRedirect = typeof redirect === 'string' && redirect.startsWith('/') && !redirect.startsWith('//') ? redirect : null;
       req.session.preAuthUser = {
-        id: user.id,
+        userId: user.UserId || undefined,
         username: user.UserName,
         role: user.Role,
         allowedApps: user.AllowedApps,
@@ -443,7 +437,7 @@ router.post("/api/login", LoginLimit, async (req, res) => {
 
     // If 2FA is not enabled, proceed with login
     const userForSession = {
-      id: user.id,
+      userId: user.UserId || undefined,
       username: user.UserName,
       role: user.Role,
       allowedApps: user.AllowedApps,
@@ -493,7 +487,7 @@ router.post("/api/verify-2fa", TwoFALimit, csrfProtection, async (req, res) => {
   }
 
   const { token, trustDevice } = req.body;
-  const { username, id, role } = req.session.preAuthUser;
+  const { username, role, userId } = req.session.preAuthUser;
 
   // Validate 2FA token
   if (!token || typeof token !== 'string') {
@@ -541,7 +535,7 @@ router.post("/api/verify-2fa", TwoFALimit, csrfProtection, async (req, res) => {
     }
 
     // 2FA successful, complete login with optional device trust
-    const userForSession = { id, username, role, allowedApps };
+    const userForSession = { userId, username, role, allowedApps };
     // Prefer redirect stored in preAuthUser or in query/body, fallback to configured default
     let redirectFromSession = req.session.preAuthUser && req.session.preAuthUser.redirectUrl ? req.session.preAuthUser.redirectUrl : null;
     if (redirectFromSession && (!(typeof redirectFromSession === 'string') || !redirectFromSession.startsWith('/') || redirectFromSession.startsWith('//'))) {
@@ -564,7 +558,7 @@ router.post("/api/verify-2fa", TwoFALimit, csrfProtection, async (req, res) => {
 router.post("/api/logout", LogoutLimit, async (req, res) => {
   if (req.session.user) {
     try {
-      const { id, username } = req.session.user;
+      const { username } = req.session.user;
 
       // Clear profile picture cache
       clearProfilePicCache(req, username);
@@ -692,7 +686,7 @@ router.post("/api/switch-session", LoginLimit, async (req, res) => {
     });
 
     req.session.user = {
-      id: row.uid,
+      userId: row.UserId || undefined,
       username: row.UserName,
       role: row.Role,
       sessionId: row.sid,
@@ -771,6 +765,7 @@ router.get("/login", LoginLimit, csrfProtection, (req, res) => {
     githubLoginEnabled: mbkautheVar.GITHUB_LOGIN_ENABLED,
     googleLoginEnabled: mbkautheVar.GOOGLE_LOGIN_ENABLED,
     customURL: mbkautheVar.loginRedirectURL || '/dashboard',
+    cookieDomain: getCookieDomain() || '',
     userLoggedIn: !!req.session?.user,
     username: req.session?.user?.username || '',
     version: packageJson.version,

package/lib/routes/misc.js

@@ -6,8 +6,9 @@ import { renderError, renderPage } from "#response.js";
 import { authenticate, sessVal, sessRole } from "../middleware/auth.js";
 import { ErrorCodes, ErrorMessages, createErrorResponse } from "../utils/errors.js";
 import { dblogin } from "#pool.js";
-import { clearSessionCookies, decryptSessionId, cachedCookieOptions } from "#cookies.js";
+import { clearSessionCookies, decryptSessionId, cachedCookieOptions, getCookieDomain } from "#cookies.js";
 import { AuthRepository } from "../db/AuthRepository.js";
+import { isSafeFetchUrl } from "../utils/urlSafety.js";
 import { fileURLToPath } from "url";
 import path from "path";
 import fs from "fs";
@@ -65,9 +66,26 @@ const AdminOperationLimit = rateLimit({
 });
 
 // Static file routes
+const mainJsPath = path.join(__dirname, '..', '..', 'public', 'main.js');
+let mainJsSource = null;
+
+const getMainJsSource = () => {
+  if (mainJsSource === null) {
+    mainJsSource = fs.readFileSync(mainJsPath, 'utf8');
+  }
+  return mainJsSource;
+};
+
 router.get('/main.js', (req, res) => {
+  const clientConfig = JSON.stringify({
+    cookieDomain: getCookieDomain() || null,
+    domain: mbkautheVar.DOMAIN,
+    isDeployed: mbkautheVar.IS_DEPLOYED === 'true'
+  });
+  const injectedSource = `window.mbkautheConfig=${clientConfig};\n${getMainJsSource()}`;
+
   res.setHeader('Cache-Control', 'public, max-age=31536000');
-  res.sendFile(path.join(__dirname, '..', '..', 'public', 'main.js'));
+  res.type('application/javascript').send(injectedSource);
 });
 
 router.get('/main.css', (req, res) => {
@@ -145,6 +163,13 @@ router.get('/user/profilepic', async (req, res) => {
       return serveDefaultIcon();
     }
 
+    if (!isSafeFetchUrl(imageUrl)) {
+      console.warn(`[mbkauthe] Blocked unsafe profile image URL for user ${username}`);
+      res.cookie('profileImageUrl', 'default', { ...cachedCookieOptions, httpOnly: false });
+      res.cookie('profileImageUser', username, { ...cachedCookieOptions, httpOnly: false });
+      return serveDefaultIcon();
+    }
+
     // Fetch and stream the image
     try {
       const imageResponse = await fetch(imageUrl, {
@@ -187,7 +212,7 @@ if (process.env.env === 'dev') {
         success: true,
         message: 'SuperAdmin access granted',
         user: user ? {
-          id: user.id,
+          userId: user.userId,
           username: user.username,
           role: user.role,
           sessionId: user.sessionId
@@ -202,7 +227,7 @@ if (process.env.env === 'dev') {
 
 // Test route
 router.get(['/test', '/'], sessVal, LoginLimit, async (req, res) => {
-  const { username, fullname, role, id, sessionId, allowedApps } = req.session.user;
+  const { username, fullname, role, userId, sessionId, allowedApps } = req.session.user;
 
   const sessionExpiry = req.session.cookie?.expires
     ? new Date(req.session.cookie.expires).toISOString()
@@ -212,7 +237,7 @@ router.get(['/test', '/'], sessVal, LoginLimit, async (req, res) => {
     username,
     fullname: fullname || 'N/A',
     role,
-    id,
+    userId: userId || 'N/A',
     sessionIdShort: sessionId.slice(0, 8),
     profilePicUrl: encodeURIComponent(username),
     displayName: fullname || username,
@@ -235,7 +260,7 @@ router.get('/api/checkSession', LoginLimit, async (req, res) => {
       return res.status(200).json({ sessionValid: false, expiry: null });
     }
 
-    const { id, sessionId } = req.session.user;
+    const { sessionId } = req.session.user;
     if (!sessionId) {
       req.session.destroy(() => { });
       clearSessionCookies(res);
@@ -359,7 +384,7 @@ router.post('/api/verifySession', LoginLimit, async (req, res) => {
     }
 
     const expiry = row.expires_at ? new Date(row.expires_at).toISOString() : null;
-    return res.status(200).json({ valid: true, expiry, username: row.UserName, role: row.Role });
+    return res.status(200).json({ valid: true, expiry });
   } catch (err) {
     console.error(`[mbkauthe] verifySession error:`, err);
     return res.status(200).json({ valid: false, expiry: null });

package/lib/routes/oauth.js

@@ -75,7 +75,7 @@ const createOAuthStrategy = async (provider, profile, done) => {
 
         // Return user data for login
         const userData = {
-            id: user.id,
+            userId: user.UserId || undefined,
             username: user.UserName,
             role: user.Role,
             allowedApps: user.AllowedApps,
@@ -309,7 +309,7 @@ const finishProviderLogin = async (req, res, provider, user, detailValue = '') =
         const oauthRedirect = req.session.oauthRedirect;
         if (oauthRedirect) delete req.session.oauthRedirect;
         req.session.preAuthUser = {
-            id: user.id,
+            userId: user.UserId || user.userId || undefined,
             username: user.UserName,
             role: user.Role,
             allowedApps: user.AllowedApps,
@@ -364,7 +364,7 @@ const createOAuthCallback = (provider, strategy) => {
                     res,
                     provider,
                     {
-                        id: oauthUser.id,
+                        UserId: oauthUser.userId,
                         UserName: oauthUser.username,
                         Role: oauthUser.role,
                         AllowedApps: oauthUser.allowedApps,
@@ -389,7 +389,7 @@ const createOAuthCallback = (provider, strategy) => {
 // Helper function to handle OAuth redirect flow
 const handleOAuthRedirect = async (req, res, user, type, method = null) => {
     const userForSession = {
-        id: user.id,
+        userId: user.UserId || user.userId || undefined,
         username: user.UserName,
         role: user.Role,
         allowedApps: user.AllowedApps,

package/lib/utils/appAccess.js

@@ -0,0 +1,8 @@
+import { mbkautheVar } from "#config.js";
+
+export function isUserAuthorizedForApp(role, allowedApps) {
+  if (role === "SuperAdmin") return true;
+  return Array.isArray(allowedApps)
+    && allowedApps.length > 0
+    && allowedApps.some((app) => app && app.toLowerCase() === mbkautheVar.APP_NAME);
+}

package/lib/utils/dbQueryLogger.js

@@ -195,7 +195,7 @@ const buildRequestContext = () => {
     method: req.method,
     url: req.originalUrl || req.url,
     ip: req.ip,
-    userId: user?.id || null,
+    userId: user?.userId || null,
     username: user?.username || null,
   };
 };

package/lib/utils/redirect.js

@@ -0,0 +1,14 @@
+/**
+ * Validates that a redirect target is a safe same-origin relative path.
+ */
+export function isSafeRelativeRedirect(value) {
+  if (typeof value !== 'string') return false;
+  const trimmed = value.trim();
+  if (!trimmed.startsWith('/') || trimmed.startsWith('//')) return false;
+  if (trimmed.includes('://') || trimmed.includes('\\')) return false;
+  return true;
+}
+
+export function sanitizeRelativeRedirect(value) {
+  return isSafeRelativeRedirect(value) ? value.trim() : null;
+}

package/lib/utils/urlSafety.js

@@ -0,0 +1,67 @@
+import { mbkautheVar } from "#config.js";
+
+const BLOCKED_HOSTNAMES = new Set([
+  'localhost',
+  '0.0.0.0',
+  'metadata.google.internal',
+  'metadata',
+]);
+
+function isPrivateIpv4(hostname) {
+  const parts = hostname.split('.').map((part) => Number(part));
+  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+    return false;
+  }
+
+  const [a, b] = parts;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 0) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  return false;
+}
+
+function isPrivateIpv6(hostname) {
+  const normalized = hostname.toLowerCase();
+  if (normalized === '::1' || normalized === '::') return true;
+  if (normalized.startsWith('fc') || normalized.startsWith('fd')) return true;
+  if (normalized.startsWith('fe80:')) return true;
+  return false;
+}
+
+function isBlockedHostname(hostname) {
+  const normalized = hostname.toLowerCase().replace(/\.$/, '');
+  if (BLOCKED_HOSTNAMES.has(normalized)) return true;
+  if (normalized.endsWith('.localhost') || normalized.endsWith('.local')) return true;
+  if (normalized.includes(':') && isPrivateIpv6(normalized)) return true;
+  if (isPrivateIpv4(normalized)) return true;
+  return false;
+}
+
+/**
+ * Returns true when a URL is safe for server-side fetch (profile images, etc.).
+ */
+export function isSafeFetchUrl(urlString) {
+  if (!urlString || typeof urlString !== 'string' || urlString === 'default') {
+    return false;
+  }
+
+  let parsed;
+  try {
+    parsed = new URL(urlString);
+  } catch {
+    return false;
+  }
+
+  const allowHttpInDev = mbkautheVar.IS_DEPLOYED !== 'true';
+  const allowedProtocols = allowHttpInDev ? ['https:', 'http:'] : ['https:'];
+  if (!allowedProtocols.includes(parsed.protocol)) return false;
+  if (parsed.username || parsed.password) return false;
+  if (!parsed.hostname) return false;
+  if (isBlockedHostname(parsed.hostname)) return false;
+
+  return true;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mbkauthe",
-  "version": "5.0.4",
+  "version": "5.1.0",
   "description": "MBKTech's reusable authentication system for Node.js applications.",
   "main": "index.js",
   "type": "module",

package/public/main.js

@@ -28,7 +28,19 @@
       return [];
     }
 
-    return [...new Set([hostname, hostname.includes('.') ? `.${hostname}` : null].filter(Boolean))];
+    const domains = new Set();
+    const configuredDomain = window.mbkautheConfig?.cookieDomain;
+
+    if (configuredDomain) {
+      domains.add(configuredDomain);
+    }
+
+    domains.add(hostname);
+    if (hostname.includes('.')) {
+      domains.add(`.${hostname}`);
+    }
+
+    return [...domains];
   };
 
   const clearCookie = (name) => {

package/test.spec.js

@@ -14,7 +14,13 @@ process.env.dbLogs = 'true';
 process.env.dbLogsCallsite = 'false';
 
 const { default: router } = await import('./lib/main.js');
-const { packageJson } = await import('./lib/config/index.js');
+const { packageJson, mbkautheVar } = await import('./lib/config/index.js');
+const {
+  resolveCookieDomain,
+  isAllowedOriginHostname,
+  getCookieDomain,
+  cachedCookieOptions
+} = await import('./lib/config/cookies.js');
 const { dblogin } = await import('./lib/pool.js');
 const {
   attachDevQueryLogger,
@@ -23,6 +29,11 @@ const {
   runWithRequestContext
 } = await import('./lib/utils/dbQueryLogger.js');
 
+const { isSafeRelativeRedirect, sanitizeRelativeRedirect } = await import('./lib/utils/redirect.js');
+const { isSafeFetchUrl } = await import('./lib/utils/urlSafety.js');
+const { hashPassword, verifyPassword } = await import('./lib/config/index.js');
+const { hashDeviceToken } = await import('./lib/config/cookies.js');
+
 const viewsPath = path.join(__dirname, 'views');
 
 const handlebarsHelpers = {
@@ -252,6 +263,7 @@ describe('mbkauthe Routes', () => {
 
       expect(response.status).toBe(200);
       expect(response.headers['content-type']).toContain('javascript');
+      expect(response.text).toMatch(/^window\.mbkautheConfig=/);
     });
 
     test('GET /icon.svg returns SVG content', async () => {
@@ -680,4 +692,64 @@ describe('mbkauthe Routes', () => {
       }
     });
   });
+
+  describe('Security hardening', () => {
+    test('sanitizeRelativeRedirect accepts safe paths and rejects open redirects', () => {
+      expect(sanitizeRelativeRedirect('/dashboard')).toBe('/dashboard');
+      expect(sanitizeRelativeRedirect('//evil.com')).toBeNull();
+      expect(sanitizeRelativeRedirect('https://evil.com')).toBeNull();
+      expect(isSafeRelativeRedirect('/app/settings')).toBe(true);
+    });
+
+    test('isSafeFetchUrl blocks localhost and allows public https URLs', () => {
+      expect(isSafeFetchUrl('https://avatars.githubusercontent.com/u/1')).toBe(true);
+      expect(isSafeFetchUrl('http://127.0.0.1/secret')).toBe(false);
+      expect(isSafeFetchUrl('https://localhost/admin')).toBe(false);
+      expect(isSafeFetchUrl('ftp://example.com/icon.png')).toBe(false);
+    });
+
+    test('verifyPassword validates peppered password hashes', async () => {
+      const username = 'test.user';
+      const password = 'test-password-123';
+      const stored = hashPassword(password, username);
+
+      expect(stored).toMatch(/^[0-9a-f]{128}$/);
+      expect(await verifyPassword(password, username, stored)).toBe(true);
+      expect(await verifyPassword('wrong-password', username, stored)).toBe(false);
+    });
+
+    test('hashDeviceToken returns a keyed hex digest', () => {
+      const token = 'a'.repeat(64);
+      expect(hashDeviceToken(token)).toMatch(/^[0-9a-f]{64}$/);
+    });
+
+    test('security headers are set on API responses', async () => {
+      const response = await request(app).get('/mbkauthe/main.js');
+      expect(response.headers['x-content-type-options']).toBe('nosniff');
+      expect(response.headers['x-frame-options']).toBe('SAMEORIGIN');
+    });
+  });
+
+  describe('Cross-subdomain cookie sharing', () => {
+    test('resolveCookieDomain returns parent domain only when deployed outside test dev', () => {
+      expect(resolveCookieDomain('true', 'mbktech.org', true)).toBeUndefined();
+      expect(resolveCookieDomain('false', 'mbktech.org', false)).toBeUndefined();
+      expect(resolveCookieDomain('true', 'mbktech.org', false)).toBe('.mbktech.org');
+      expect(resolveCookieDomain('true', '.mbktech.org', false)).toBe('.mbktech.org');
+    });
+
+    test('isAllowedOriginHostname accepts root and nested subdomains', () => {
+      expect(isAllowedOriginHostname('mbktech.org', 'mbktech.org')).toBe(true);
+      expect(isAllowedOriginHostname('auth.mbktech.org', 'mbktech.org')).toBe(true);
+      expect(isAllowedOriginHostname('app.auth.mbktech.org', 'mbktech.org')).toBe(true);
+      expect(isAllowedOriginHostname('notmbktech.org', 'mbktech.org')).toBe(false);
+      expect(isAllowedOriginHostname('mbktech.org.evil.com', 'mbktech.org')).toBe(false);
+    });
+
+    test('cached cookie options omit domain in test dev environment', () => {
+      expect(getCookieDomain()).toBeUndefined();
+      expect(cachedCookieOptions.domain).toBeUndefined();
+      expect(cachedCookieOptions.secure).toBe(false);
+    });
+  });
 });

package/views/pages/accountSwitch.handlebars

@@ -340,7 +340,15 @@
     </style>
 
     <script>
-        const redirectTarget = new URLSearchParams(window.location.search).get('redirect') || '{{customURL}}';
+        function sanitizeRelativeRedirect(value) {
+            if (typeof value !== 'string') return null;
+            const trimmed = value.trim();
+            if (!trimmed.startsWith('/') || trimmed.startsWith('//')) return null;
+            if (trimmed.includes('://') || trimmed.includes('\\')) return null;
+            return trimmed;
+        }
+
+        const redirectTarget = sanitizeRelativeRedirect(new URLSearchParams(window.location.search).get('redirect')) || '{{customURL}}';
 
         // Ensure login anchors include ?redirect using the redirect query param (not the current page URL)
         (function setLoginHrefFromQuery() {
@@ -485,16 +493,8 @@
                 if (res.ok && data.success) {
                     // Prioritize explicit ?redirect if present and valid, else fall back to server-provided redirect or template
                     const params = new URLSearchParams(window.location.search);
-                    let queryRedirect = null;
-                    if (params.has('redirect')) {
-                        try {
-                            const raw = params.get('redirect');
-                            if (raw) queryRedirect = decodeURIComponent(raw);
-                        } catch (e) {
-                            queryRedirect = null;
-                        }
-                    }
-                    const finalRedirect = queryRedirect || data.redirect || redirectTarget;
+                    const queryRedirect = sanitizeRelativeRedirect(params.get('redirect'));
+                    const finalRedirect = data.redirect || queryRedirect || redirectTarget;
                     if (finalRedirect) window.location.href = finalRedirect;
                 } else {
                     showMessage(data.message || 'Could not switch account', 'Switch Account');

package/views/pages/loginmbkauthe.handlebars

@@ -249,6 +249,14 @@
     {{> versionInfo}}
 
     <script>
+        function sanitizeRelativeRedirect(value) {
+            if (typeof value !== 'string') return null;
+            const trimmed = value.trim();
+            if (!trimmed.startsWith('/') || trimmed.startsWith('//')) return null;
+            if (trimmed.includes('://') || trimmed.includes('\\')) return null;
+            return trimmed;
+        }
+
         // Toggle password visibility
         const togglePassword = document.getElementById('togglePassword');
         const passwordInput = document.getElementById('loginPassword');
@@ -301,7 +309,7 @@
 
             // Pass redirect query param through to server so it can be used by 2FA flow
             const urlParams = new URLSearchParams(window.location.search);
-            const pageRedirect = urlParams.get('redirect');
+            const pageRedirect = sanitizeRelativeRedirect(urlParams.get('redirect'));
             fetch('/mbkauthe/api/login', {
                 method: 'POST',
                 credentials: 'include',
@@ -330,9 +338,8 @@
                                 deleteCookie('rememberedUsername');
                             }
 
-                            // Redirect to the appropriate page
-                            const redirectUrl = new URLSearchParams(window.location.search).get('redirect');
-                            window.location.href = redirectUrl ? decodeURIComponent(redirectUrl) : '{{customURL}}';
+                            // Redirect to the validated target from the server or safe query param
+                            window.location.href = data.redirectUrl || pageRedirect || '{{customURL}}';
                         }
                     } else {
                         // Handle errors
@@ -349,7 +356,9 @@
                 });
         });
 
-        // Cookie helper functions for cross-domain functionality
+        // Cookie helper functions for cross-subdomain sharing
+        const cookieDomain = '{{cookieDomain}}';
+
         function setCookie(name, value, days) {
             let expires = "";
             if (days) {
@@ -357,11 +366,11 @@
                 date.setTime(date.getTime() + (days * 24 * 60 * 60 * 1000));
                 expires = "; expires=" + date.toUTCString();
             }
-            // Set cookie for the entire domain (works across all subdomains)
-            const domain = window.location.hostname.includes('.') ?
-                '.' + window.location.hostname.split('.').slice(-2).join('.') :
-                window.location.hostname;
-            document.cookie = name + "=" + (value || "") + expires + "; path=/; domain=" + domain + "; SameSite=Lax";
+            let cookieValue = name + "=" + (value || "") + expires + "; path=/; SameSite=Lax";
+            if (cookieDomain) {
+                cookieValue += "; domain=" + cookieDomain;
+            }
+            document.cookie = cookieValue;
         }
 
         function getCookie(name) {
@@ -376,19 +385,26 @@
         }
 
         function deleteCookie(name) {
-            const domain = window.location.hostname.includes('.') ?
-                '.' + window.location.hostname.split('.').slice(-2).join('.') :
-                window.location.hostname;
-            document.cookie = name + "=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/; domain=" + domain;
+            let cookieValue = name + "=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/";
+            if (cookieDomain) {
+                cookieValue += "; domain=" + cookieDomain;
+            }
+            document.cookie = cookieValue;
         }
 
         // Check for URL parameters
         document.addEventListener('DOMContentLoaded', function () {
             const urlParams = new URLSearchParams(window.location.search);
-            const usernameFromUrl = urlParams.get('username');
-            const passwordFromUrl = urlParams.get('password');
             const usernameInput = document.getElementById('loginUsername');
 
+            if (urlParams.has('password')) {
+                urlParams.delete('password');
+                const sanitizedQuery = urlParams.toString();
+                const nextUrl = `${window.location.pathname}${sanitizedQuery ? `?${sanitizedQuery}` : ''}${window.location.hash}`;
+                window.history.replaceState({}, document.title, nextUrl);
+                showMessage('Passwords must not be passed in the URL. Enter your password in the form instead.', 'Security Notice');
+            }
+
             // Check for remembered username in cookies
             const rememberedUsername = getCookie('rememberedUsername');
             if (rememberedUsername) {
@@ -396,14 +412,6 @@
                 document.getElementById('rememberMe').checked = true;
             }
 
-            if (usernameFromUrl) {
-                usernameInput.value = usernameFromUrl;
-            }
-
-            if (passwordFromUrl) {
-                document.getElementById('loginPassword').value = passwordFromUrl;
-            }
-
             // Automatically focus the first empty field
             if (!usernameInput.value) {
                 usernameInput.focus();

package/views/pages/test.handlebars

@@ -194,7 +194,7 @@
                 <div>
                     <div class="session-status">✅ Authentication successful</div>
                     <h3 class="session-title">{{username}} <small class="session-role">· {{role}}</small></h3>
-                    <p class="session-sub">ID: {{id}} · Session: {{sessionIdShort}}…</p>
+                    <p class="session-sub">UserId: {{userId}} · Session: {{sessionIdShort}}…</p>
                 </div>
 
                 <div class="session-details" aria-live="polite">