feat: Store accessToken in cookies instead of localStorage

server/api/hooks/current-user/index.js

@@ -34,11 +34,16 @@ module.exports = function defineCurrentUserHook(sails) {
       before: {
         '/*': {
           async fn(req, res, next) {
-            const { authorization: authorizationHeader } = req.headers;
-
-            if (authorizationHeader && TOKEN_PATTERN.test(authorizationHeader)) {
-              const accessToken = authorizationHeader.replace(TOKEN_PATTERN, '');
+            let accessToken;
+            if (req.headers.authorization) {
+              if (TOKEN_PATTERN.test(req.headers.authorization)) {
+                accessToken = req.headers.authorization.replace(TOKEN_PATTERN, '');
+              }
+            } else if (req.cookies.accessToken) {
+              accessToken = req.cookies.accessToken;
+            }
 
+            if (accessToken) {
               req.currentUser = await getUser(accessToken);
             }
 

server/config/security.js

@@ -31,7 +31,7 @@ module.exports.security = {
     allRoutes: true,
     allowOrigins: ['http://localhost:3000'],
     allowRequestHeaders: ['Authorization'],
-    allowCredentials: false,
+    allowCredentials: true,
   },
 
   /**