From bf9e780b1b4e7c325df9fe60f9ea60daf3362e12 Mon Sep 17 00:00:00 2001 From: mhoennig Date: Mon, 31 Aug 2026 10:25:14 +0200 Subject: [PATCH] Drop the control token left under the old localStorage key The key is named after the product, so the rename left every browser with a token under `gittally.controlToken`, which nothing reads any more and which "forget token" can no longer reach. It is a write-scope token in a browser store, not a password, but a secret nobody owns is worth one line to remove. Removed on load. The token on the server is unchanged, so re-entering it once per browser is all the rename costs. Co-Authored-By: Claude Opus 5 --- src/main/resources/static/werkator.js | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/main/resources/static/werkator.js b/src/main/resources/static/werkator.js index 0e70b82..74253ad 100644 --- a/src/main/resources/static/werkator.js +++ b/src/main/resources/static/werkator.js @@ -105,6 +105,16 @@ const giteaRepoUrl = metaContent("werkator-gitea-repo-url"); // it is kept in localStorage and only ever sent as a request header. const CONTROL_TOKEN_KEY = "werkator.controlToken"; +// The key was named after the old product name, so the rename left every browser +// with a token under a name nothing reads any more — a secret that not even +// "forget token" can reach. Dropped on load; the token itself is unchanged on the +// server, so the one re-entry per browser is all the rename costs. +try { + window.localStorage.removeItem("gittally.controlToken"); +} catch (error) { + // localStorage unavailable (private mode, blocked cookies) — nothing stored, nothing to drop +} + function storedControlToken() { try { return window.localStorage.getItem(CONTROL_TOKEN_KEY) || "";