Skip to content

security: fix missing Secure attribute on cookies - #1217

Closed
elie222 wants to merge 24 commits into
mainfrom
fix/secure-cookies
Closed

security: fix missing Secure attribute on cookies#1217
elie222 wants to merge 24 commits into
mainfrom
fix/secure-cookies

security: add Secure attribute to cookies

2db6dfb
Select commit
Loading
Failed to load commit list.
MacroscopeApp / Macroscope - Correctness Check completed Jan 6, 2026 in 3m 0s

2 issues identified (42 code objects reviewed).

• Merge Base: fa40fa2
• Head: 2db6dfb

Details

✅ File Path Comments Posted
✅ apps/web/app/(app)/(redirects)/bulk-archive/page.tsx 0
✅ apps/web/app/(app)/(redirects)/quick-bulk-archive/page.tsx 0
✅ apps/web/app/(app)/[emailAccountId]/bulk-archive/AutoCategorizationSetup.tsx 0
✅ apps/web/app/(app)/[emailAccountId]/bulk-archive/BulkArchiveContent.tsx 0
✅ apps/web/app/(app)/[emailAccountId]/bulk-archive/BulkArchiveProgress.tsx 0
✅ apps/web/app/(app)/[emailAccountId]/bulk-archive/page.tsx 0
✅ apps/web/app/(app)/[emailAccountId]/calendars/ConnectCalendar.tsx 0
✅ apps/web/app/(app)/[emailAccountId]/quick-bulk-archive/BulkArchiveTab.tsx 0
✅ apps/web/app/(app)/[emailAccountId]/quick-bulk-archive/page.tsx 0
✅ apps/web/app/(app)/early-access/page.tsx 0
✅ apps/web/app/api/user/categorize/senders/batch/handle-batch.ts 0
✅ apps/web/app/api/user/categorize/senders/categorized/route.ts 0
✅ apps/web/app/utm.tsx 0
❌ apps/web/components/BulkArchiveCards.tsx 2
✅ apps/web/components/EmailCell.tsx 0
✅ apps/web/components/ProgressPanel.tsx 0
✅ apps/web/components/bulk-archive/categoryIcons.ts 0
✅ apps/web/components/ui/sidebar.tsx 0
✅ apps/web/utils/actions/categorize.ts 0
✅ apps/web/utils/auth-cookies.ts 0
✅ apps/web/utils/bulk-archive/get-archive-candidates.ts 0
✅ apps/web/utils/cookies.ts 0

Filtered Issues Details

apps/web/app/(app)/[emailAccountId]/quick-bulk-archive/BulkArchiveTab.tsx
  • line 78: The selectedSenders state is initialized once using emailGroups (lines 78-89), but if the emailGroups prop changes after mount, the state will not update to reflect the new candidates. This could lead to selectedSenders referencing addresses that no longer exist in candidates, causing the UI to show incorrect selection counts or attempting to archive non-existent senders. [ Low confidence ]
  • line 401: The SenderRow component is used on lines 401-413 but there is no import statement for it in the visible code. If SenderRow is not defined elsewhere in this file or properly imported, this will cause a ReferenceError: SenderRow is not defined at runtime when the expanded section attempts to render sender rows. [ Previously rejected ]
  • line 506: In ArchiveStatus, the condition if (status.threadsTotal) on line 467/506 treats 0 as falsy. If threadsTotal is actually 0 (no threads found for a sender), the component displays "Archived" instead of "Archived 0!". While this may be intentional, it could be misleading to users since it doesn't clearly indicate that zero emails were archived. [ Low confidence ]
  • line 571: Accessing thread.messages[0] on line 571 will throw a TypeError if thread.messages is undefined or not an array. The code checks if firstMessage is falsy after the access, but if messages itself is undefined, the property access [0] will crash before that check can execute. [ Low confidence ]
  • line 591: Accessing subject.length and subject.slice() on lines 591-593 will throw a TypeError if firstMessage.subject is undefined or null. While firstMessage is null-checked on line 572, there is no validation that subject is a defined string before calling string methods on it. [ Previously rejected ]
apps/web/app/utm.tsx
  • line 18: Adding the Secure flag to cookies will prevent them from being set when the application is accessed over HTTP (e.g., http://localhost during development). This could cause UTM tracking to silently fail in non-HTTPS environments, with no error thrown but cookies simply not being stored. [ Low confidence ]
apps/web/components/BulkArchiveCards.tsx
  • line 54: The useArchiveSenderStatus hook is imported on line 28 but never used in the component. This suggests incomplete implementation - the archive status for individual senders should likely be displayed in the SenderRow component to show archive progress, but this integration appears to be missing. [ Low confidence ]
  • line 156: In archiveCategory (lines 148-169), if addToArchiveSenderQueue throws an error for any sender, the loop exits immediately and remaining senders won't be queued. The category won't be marked as archived, but already-queued senders will still be processed. On retry, users would attempt to archive all senders again, though the queue handles duplicates. Consider whether partial success should be handled differently. [ Low confidence ]
  • line 350: The SenderRow component is used on line 350 but is neither imported nor defined in this file. This will cause a runtime ReferenceError: SenderRow is not defined when the expanded category view attempts to render sender rows. The imports section (lines 1-40) does not include SenderRow, and it is not defined within the component code. [ Previously rejected ]
  • line 384: When onEditCategory is called with "Uncategorized" (line 274), the CreateCategoryDialog will receive category={undefined} (line 382-385) because "Uncategorized" is a synthetic category name that won't match any category in the categories array. This means clicking Edit on the Uncategorized category opens a "Create Category" dialog with no pre-filled data, which may be confusing UX behavior rather than the expected edit experience. [ Low confidence ]
  • line 467: In ArchiveStatus, the condition if (status.threadsTotal) on line 467/506 treats 0 as falsy. If threadsTotal is actually 0 (no threads found for a sender), the component displays "Archived" instead of "Archived 0!". While this may be intentional, it could be misleading to users since it doesn't clearly indicate that zero emails were archived. [ Low confidence ]
  • line 532: Accessing thread.messages[0] assumes thread.messages is an array. If thread.messages is undefined or null, this will throw a TypeError. The null check on line 533 only handles the case where the array is empty, not where messages itself is missing. [ Low confidence ]
apps/web/components/bulk-archive/categoryIcons.ts
  • line 23: Calling .toLowerCase() on categoryName will throw a TypeError if categoryName is null or undefined. The function has no guard against these inputs, and callers may pass them when category data is missing or not yet loaded. [ Previously rejected ]
apps/web/utils/auth-cookies.ts
  • line 10: Adding the Secure flag to the cookie deletion may cause the cookie to not be properly cleared when running on non-HTTPS environments (e.g., http://localhost during development). Browsers will ignore or fail to process cookies with the Secure attribute on HTTP connections, leaving the auth_error cookie in place and potentially causing stale error messages to persist. [ Low confidence ]
apps/web/utils/cookies.ts
  • line 12: Adding the Secure flag means cookies will not be set when the application is accessed over HTTP (except localhost in some browsers). If the application is used in development environments with HTTP on non-localhost domains, or in any HTTP deployment scenario, markOnboardingAsCompleted will silently fail to persist the cookie, causing onboarding screens to reappear repeatedly. [ Low confidence ]
  • line 16: Adding the Secure flag means the invitation cookie will not be set when accessed over HTTP (except localhost in some browsers). In HTTP environments, setInvitationCookie will silently fail, breaking the invitation flow without any error indication. [ Low confidence ]
View more details on MacroscopeApp