Problem
Opening a generated hosted-app preview_url from LibreChat is a cross-site top-level navigation. The authorize handler sets __Host-codeapi-app with SameSite=Strict and immediately returns a 303 to /. The redirect remains part of the cross-site navigation chain, so browsers can withhold the new Strict cookie on the redirected request; the first preview load then returns 401 Preview authorization required even though the cookie was stored.
Source: service/src/hosted-app/preview-gateway.ts in merged PR #58 / commit 9df5cf8ae007b7732f894a82596cc8db8985861f.
Expected
A fresh preview_url should render the app on its first navigation without requiring a manual refresh, while preserving the host-only, secure, HttpOnly authorization boundary.
Suggested coverage
Add a browser-level cross-site navigation test for the authorize → 303 → / flow and use cookie/redirect semantics compatible with that flow (for example, SameSite=Lax for the read-entry cookie if the security model permits it).
Problem
Opening a generated hosted-app
preview_urlfrom LibreChat is a cross-site top-level navigation. The authorize handler sets__Host-codeapi-appwithSameSite=Strictand immediately returns a 303 to/. The redirect remains part of the cross-site navigation chain, so browsers can withhold the new Strict cookie on the redirected request; the first preview load then returns401 Preview authorization requiredeven though the cookie was stored.Source:
service/src/hosted-app/preview-gateway.tsin merged PR #58 / commit9df5cf8ae007b7732f894a82596cc8db8985861f.Expected
A fresh
preview_urlshould render the app on its first navigation without requiring a manual refresh, while preserving the host-only, secure, HttpOnly authorization boundary.Suggested coverage
Add a browser-level cross-site navigation test for the authorize → 303 →
/flow and use cookie/redirect semantics compatible with that flow (for example,SameSite=Laxfor the read-entry cookie if the security model permits it).