From e6f8a223dfbe8fe4fc426373f777dbf2e1472c1a Mon Sep 17 00:00:00 2001
From: Zoe Roux <zoe.roux@zoriya.dev>
Date: Sat, 21 Mar 2026 23:47:04 +0100
Subject: [PATCH] Handle cookies in auth codepath

---
 auth/main.go                    | 15 +++++++++++++--
 front/src/providers/settings.ts |  3 +--
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/auth/main.go b/auth/main.go
index fbb6ccaa..98268f79 100644
--- a/auth/main.go
+++ b/auth/main.go
@@ -171,14 +171,25 @@ func (h *Handler) TokenToJwt(next echo.HandlerFunc) echo.HandlerFunc {
 			jwt = &token
 		} else {
 			auth := c.Request().Header.Get("Authorization")
+			var token string
 
-			if auth == "" || !strings.HasPrefix(auth, "Bearer ") {
+			if auth == "" {
+				cookie, _ := c.Request().Cookie("X-Bearer")
+				if cookie != nil {
+					token = cookie.Value
+				}
+			} else if strings.HasPrefix(auth, "Bearer ") {
+				token = auth[len("Bearer "):]
+			} else if auth != "" {
+				return echo.NewHTTPError(http.StatusUnauthorized, "Invalid bearer format.")
+			}
+
+			if token == "" {
 				jwt = h.createGuestJwt()
 				if jwt == nil {
 					return echo.NewHTTPError(http.StatusUnauthorized, "Guests not allowed.")
 				}
 			} else {
-				token := auth[len("Bearer "):]
 				// this is only used to check if it is a session token or a jwt
 				_, err := base64.RawURLEncoding.DecodeString(token)
 				if err != nil {
diff --git a/front/src/providers/settings.ts b/front/src/providers/settings.ts
index 068bf047..52cda316 100644
--- a/front/src/providers/settings.ts
+++ b/front/src/providers/settings.ts
@@ -3,7 +3,7 @@ import { createMMKV, useMMKVString } from "react-native-mmkv";
 import type { ZodType, z } from "zod/v4";
 import { getServerData } from "~/utils";
 
-export const storage = createMMKV();
+export const storage = createMMKV({ id: "kyoo-v5" });
 
 function toBase64(utf8: string) {
 	if (typeof window !== "undefined") return window.btoa(utf8);
@@ -35,7 +35,6 @@ export const setCookie = (
 
 export const readCookie = <T extends ZodType>(key: string, parser: T) => {
 	const cookies = getServerData("cookies");
-	console.log("cookies", cookies);
 	const decodedCookie = decodeURIComponent(cookies);
 	const ca = decodedCookie.split(";");