openvibers/openvibe.shared Commits

Shared: middleware extractToken drops the legacy token cookie (C-05) (#61)

OP OpenVibers committed 11 Oct 2026 · 5477c60519 · 2 files, +6 −1

Compatibility register C-05: Live's legacy `token` cookie goes everywhere. Live#95 stops setting and reading it, and Chat#72 stops reading it.

`middleware.js` `extractToken` drops its `req.cookies.token` fallback and now reads the bearer, `ov_token` and the WebSocket query parameter. No OpenVibers service imports this module, which I checked across every repository, so nothing changes at runtime. The change rides the next release, and its CHANGELOG entry is under Unreleased, marked breaking for anyone outside who relied on the cookie.

`node --check` passes.

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex ac4eca5..b15907a 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -4,6 +4,12 @@ All notable changes to `openvibe-shared`. Versions follow [semver](https://semve
  breaking change to any exported module, browser global or served file name is a new major.
  A release is the git tag `vX.Y.Z`; consumers pin the tag's tarball (see README).
  
++## Unreleased
++
++- **Breaking (for a caller relying on it):** `middleware.js` `extractToken` no longer reads Live's legacy `token`
++  cookie: only the bearer, `ov_token` and the WebSocket query parameter. Live stopped setting that cookie and Chat
++  stopped reading it (compatibility register C-05). No OpenVibers service imports this module today.
++
  ## 3.0.1 — 2026-10-10
  
  - `notification-live.js` (the bell's realtime feed) resumes from Events' opaque cursor: `last_event_id` is the last
ddiff --git a/middleware.js b/middleware.js
iindex a4df217..d4e975b 100644
---- a/middleware.js
++++ b/middleware.js
@@@ -19,7 +19,6 @@ function extractToken(req) {
      }
      // 2. Cookie
      if (req.cookies?.ov_token) return req.cookies.ov_token;
--    if (req.cookies?.token) return req.cookies.token;  // legacy compat
      // 3. Query param (WebSocket upgrade)
      if (req.query?.token) return req.query.token;
      return null;