spupuz/VibeNVR

🐛 Bug Fixes

• media_token cookie not refreshed on session bootstrap (routers/auth.py)
  The me-from-cookie endpoint (used to restore the session on page reload) was not re-setting the media_token cookie. This caused persistent 401 Unauthorized errors on Live View in the following scenarios:

  • Session was originally established with COOKIE_SECURE=true (HTTPS) and then accessed over HTTP
  • The media_token had expired while the auth_token was still valid
  • The user upgraded from a version prior to the HttpOnly cookie migration

  me-from-cookie now always refreshes the media_token cookie using the current COOKIE_SECURE setting.

📦 What Changed

| File | Change |
|------|--------|
| backend/routers/auth.py | me-from-cookie now re-sets the media_token cookie on every call |
| frontend/package.json | Version bump 1.20.1 → 1.20.2 |
| backend/package.json | Version bump 1.20.1 → 1.20.2 |

⬆️ How to Update

docker compose -f docker-compose.prod.yml pull
docker compose -f docker-compose.prod.yml down
docker compose -f docker-compose.prod.yml up -d

Still seeing 401 on Live View after updating? Do a hard refresh (Ctrl+Shift+R) to clear the cached JavaScript bundle.

No .env changes required.