fix: update cookie settings to include HttpOnly for enhanced security

Author: Ajit Kumar

src/lib/adRewards.js

@@ -179,7 +179,7 @@ function scheduleExpiryCheck() {
 
 async function getRewardIdentity() {
 	try {
-		const userId = user?.id || "Guest";
+		return String(user?.id || "Guest");
 	} catch (error) {
 		console.warn("Failed to resolve rewarded ad user identity.", error);
 		return String(device?.uuid || "guest");

src/lib/checkPluginsUpdate.js

@@ -1,5 +1,6 @@
 import fsOperation from "fileSystem";
 import Url from "utils/Url";
+import config from "./config";
 
 export default async function checkPluginsUpdate() {
 	const plugins = await fsOperation(PLUGIN_DIR).lsDir();
@@ -13,9 +14,9 @@ export default async function checkPluginsUpdate() {
 					Url.join(pluginDir.url, "plugin.json"),
 				).readFile("json");
 
-				const res = await fetch({
-					url: `https://acode.app/api/plugin/check-update/${plugin.id}/${plugin.version}`,
-				});
+				const res = await fetch(
+					`${config.API_BASE}/plugin/check-update/${plugin.id}/${plugin.version}`,
+				);
 
 				if (res.ok) {
 					const json = await res.json();

src/pages/sponsor/sponsor.js

@@ -17,7 +17,6 @@ import helpers from "utils/helpers";
  * @param {() => void} onclose
  */
 export default function Sponsor(onclose) {
-	const BASE_URL = "https://acode.app/res/";
 	const $page = Page(strings.sponsor);
 	let cancel = false;
 
@@ -67,12 +66,7 @@ export default function Sponsor(onclose) {
 						msg += `Error: ${rejectedPromise.reason}\n`;
 						msg += `Code: ${rejectedPromise.value.resCode}`;
 					} else {
-						const res = await fetch({
-							url: BASE_URL + "6.jpeg",
-							responseType: "blob",
-						}).catch((err) => {
-							helpers.error(err);
-						});
+						const res = await fetch(`${config.BASE_URL}/res/6.jpeg`);
 
 						if (res.ok) {
 							const url = URL.createObjectURL(await res.blob());

src/plugins/auth/src/android/Authenticator.java

@@ -58,7 +58,7 @@ public boolean execute(String action, JSONArray args, CallbackContext callbackCo
     private void setTokenCookie(String token) {
         CookieManager cm = CookieManager.getInstance();
         for (String origin : API_ORIGINS) {
-            cm.setCookie(origin, "token=" + token + "; Path=/; Secure; SameSite=None");
+            cm.setCookie(origin, "token=" + token + "; Path=/; Secure; HttpOnly; SameSite=None");
         }
         cm.flush();
     }