fix/sessions token exposed in url query parameters

[ilikeworking2005]

Overview

This PR addresses Issue #30, where highly sensitive session tokens were being exposed in URL query parameters for the video streaming and preview endpoints. To secure the authentication flow and prevent token leakage in server logs and browser history, this PR migrates the application from using URL query parameters and custom headers (X-User-Token) to HttpOnly Secure Cookies.

Changes Proposed

1. app/api/auth.py (Login/Session Creation): Updated the /select route to inject the Response object. Upon successful session creation, the token is now attached to the HTTP response as an HttpOnly, Secure, and SameSite=Lax cookie rather than just being returned in the JSON body.

2. app/api/auth.py (Auth Dependency): Refactored the get_current_user dependency to read the incoming Request object. It now extracts the session token directly from request.cookies.get("session_token") instead of relying on the X-User-Token header.

3. app/api/videos.py (Video Endpoints): Removed the token URL query parameter from both /{video_id}/stream and /{video_id}/preview-stream. These routes now rely entirely on the updated get_current_user cookie dependency.

Security Benefits

By leveraging browser-managed cookies, we resolve the vulnerabilities outlined in the original issue while gaining additional security benefits:

- No URL Leakage: Session tokens will no longer appear in proxy logs, server access logs, or the user's browser history.

- XSS Protection: Setting the HttpOnly flag ensures that malicious JavaScript cannot access or exfiltrate the session token if a Cross-Site Scripting vulnerability is ever introduced.

- Native Media Support: HTML

Breaking Changes & Frontend Impact

This PR introduces a breaking change to how the frontend communicates with the API. The frontend developer will need to implement the following updates:

- Remove Manual Headers: The frontend no longer needs to manually attach the X-User-Token header to API calls.

- Enable Credentials: All XHR, Fetch, or Axios requests must be configured to include credentials (e.g., credentials: "include" in Fetch, or withCredentials: true in Axios) so the browser knows to send the cookie.

- Video Tags: Video players can now simply use

How to Test

1. Check out this branch and start the backend server.

2. Authenticate via the /select endpoint and verify via your browser's DevTools (Application > Cookies tab) that the session_token cookie is set correctly with the HttpOnly flag.

3. Attempt to access a protected API route without the cookie (e.g., via standard curl or incognito window); verify it returns a 401 Unauthorized.

4. Load a video stream using a standard HTML