fix(guest): move guest token from URL query to sessionStorage (#21) #28

Open

hermes wants to merge 1 commit from fix/guest-token-session-storage into master

Author	SHA1	Message	Date
Hermes Agent	120251867c	fix(guest): move guest token from URL query to sessionStorage Some checks failed CI / Lint, type check, unit tests, coverage (pull_request) Successful in 3m38s Details CI / E2E browser tests (pull_request) Failing after 1m16s Details The guest token (the customer's only credential) was passed as ?token=... in the URL query string on the payment page. Query strings land in browser history, nginx/reverse-proxy access logs, and can leak via Referer headers. The magic-link landing /gast-order/:token is inherently URL-based (accepted Notion/Stripe pattern), but the payment page does not need to expose the token in the URL. Changes: - GuestCheckoutPage.vue: store token in sessionStorage before navigating to payment page; remove token from query string - GuestOrderPage.vue: replace RouterLink with click handler that stores token in sessionStorage before navigating to payment; add useRouter import - GuestPaymentRedirect.vue: read token from sessionStorage with fallback to query.token for backward compatibility with existing magic links - GuestCheckoutPage.spec.ts: assert token is NOT in query, IS in sessionStorage after navigation - GuestPaymentRedirect.spec.ts: set sessionStorage in mount helper; clear sessionStorage in beforeEach sessionStorage persists across page refreshes within the same tab, so the payment page still survives refresh. If the user opens the payment URL in a new tab (from history), sessionStorage is lost — but the canonical re-entry point is the magic link /gast-order/:token, from which they can navigate to payment again. Closes #21	2026-07-18 11:41:58 +00:00

Author

SHA1

Message

Date

Hermes Agent

120251867c

fix(guest): move guest token from URL query to sessionStorage

CI / Lint, type check, unit tests, coverage (pull_request) Successful in 3m38s

Details

CI / E2E browser tests (pull_request) Failing after 1m16s

Details

The guest token (the customer's only credential) was passed as
?token=... in the URL query string on the payment page. Query strings
land in browser history, nginx/reverse-proxy access logs, and can leak
via Referer headers.

The magic-link landing /gast-order/:token is inherently URL-based
(accepted Notion/Stripe pattern), but the payment page does not need to
expose the token in the URL.

Changes:
  - GuestCheckoutPage.vue: store token in sessionStorage before
    navigating to payment page; remove token from query string
  - GuestOrderPage.vue: replace RouterLink with click handler that
    stores token in sessionStorage before navigating to payment;
    add useRouter import
  - GuestPaymentRedirect.vue: read token from sessionStorage with
    fallback to query.token for backward compatibility with existing
    magic links
  - GuestCheckoutPage.spec.ts: assert token is NOT in query, IS in
    sessionStorage after navigation
  - GuestPaymentRedirect.spec.ts: set sessionStorage in mount helper;
    clear sessionStorage in beforeEach

sessionStorage persists across page refreshes within the same tab, so
the payment page still survives refresh. If the user opens the payment
URL in a new tab (from history), sessionStorage is lost — but the
canonical re-entry point is the magic link /gast-order/:token, from
which they can navigate to payment again.

Closes #21

2026-07-18 11:41:58 +00:00