From 35c8757d2e94d3b90e1304497f0dec6cb6fad2df Mon Sep 17 00:00:00 2001
From: sadiq khan <sadiqali94@gmail.com>
Date: Fri, 14 Aug 2026 23:06:04 +0530
Subject: [PATCH 1/2] Fix config namespace in the security cookie route

config('native-php.secret') reads a namespace that does not exist; the config
files are nativephp.php and nativephp-internal.php. The guard therefore compared
user input against null, so it passed only when no secret was supplied, and the
cookie it issued had a null value.

This is also the one route PreventRegularBrowserAccess deliberately exempts, so
it is worth having work as intended.
---
 src/Http/Controllers/CreateSecurityCookieController.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/Http/Controllers/CreateSecurityCookieController.php b/src/Http/Controllers/CreateSecurityCookieController.php
index 6736ca2..b2c0e78 100644
--- a/src/Http/Controllers/CreateSecurityCookieController.php
+++ b/src/Http/Controllers/CreateSecurityCookieController.php
@@ -8,11 +8,11 @@ class CreateSecurityCookieController
 {
     public function __invoke(Request $request)
     {
-        abort_if($request->input('secret') !== config('native-php.secret'), 403);
+        abort_if($request->input('secret') !== config('nativephp-internal.secret'), 403);
 
         return redirect('/')->cookie(cookie(
             name: '_php_native',
-            value: config('native-php.secret'),
+            value: config('nativephp-internal.secret'),
             domain: 'localhost',
             httpOnly: true,
         ));

From a1ddd7a63ca601c89e8e156d4588664b1a1195ad Mon Sep 17 00:00:00 2001
From: sadiq khan <sadiqali94@gmail.com>
Date: Wed, 19 Aug 2026 09:42:44 +0530
Subject: [PATCH 2/2] Remove the dead security cookie route

Nothing calls _native/api/cookie: Electron sets _php_native itself via
appendCookie() at boot and sends X-NativePHP-Secret on every request, so
the route, its controller, its test and the middleware exemption all go.
---
 routes/api.php                                |  3 ---
 .../CreateSecurityCookieController.php        | 20 -------------------
 .../PreventRegularBrowserAccess.php           |  5 -----
 .../CreateSecurityCookieControllerTest.php    | 18 -----------------
 4 files changed, 46 deletions(-)
 delete mode 100644 src/Http/Controllers/CreateSecurityCookieController.php
 delete mode 100644 tests/Http/Controller/CreateSecurityCookieControllerTest.php

diff --git a/routes/api.php b/routes/api.php
index 0220740..64d0af2 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -2,7 +2,6 @@
 
 use App\Http\Middleware\VerifyCsrfToken;
 use Illuminate\Support\Facades\Route;
-use Native\Desktop\Http\Controllers\CreateSecurityCookieController;
 use Native\Desktop\Http\Controllers\DispatchEventFromAppController;
 use Native\Desktop\Http\Controllers\NativeAppBootedController;
 use Native\Desktop\Http\Middleware\OptionalNightwatchNever;
@@ -12,5 +11,3 @@
     Route::post('_native/api/booted', NativeAppBootedController::class);
     Route::post('_native/api/events', DispatchEventFromAppController::class);
 })->withoutMiddleware(VerifyCsrfToken::class);
-
-Route::get('_native/api/cookie', CreateSecurityCookieController::class)->middleware(OptionalNightwatchNever::class);
diff --git a/src/Http/Controllers/CreateSecurityCookieController.php b/src/Http/Controllers/CreateSecurityCookieController.php
deleted file mode 100644
index b2c0e78..0000000
--- a/src/Http/Controllers/CreateSecurityCookieController.php
+++ /dev/null
@@ -1,20 +0,0 @@
-<?php
-
-namespace Native\Desktop\Http\Controllers;
-
-use Illuminate\Http\Request;
-
-class CreateSecurityCookieController
-{
-    public function __invoke(Request $request)
-    {
-        abort_if($request->input('secret') !== config('nativephp-internal.secret'), 403);
-
-        return redirect('/')->cookie(cookie(
-            name: '_php_native',
-            value: config('nativephp-internal.secret'),
-            domain: 'localhost',
-            httpOnly: true,
-        ));
-    }
-}
diff --git a/src/Http/Middleware/PreventRegularBrowserAccess.php b/src/Http/Middleware/PreventRegularBrowserAccess.php
index 2e48208..19e35de 100644
--- a/src/Http/Middleware/PreventRegularBrowserAccess.php
+++ b/src/Http/Middleware/PreventRegularBrowserAccess.php
@@ -13,11 +13,6 @@ public function handle(Request $request, Closure $next)
             return $next($request);
         }
 
-        // Explicitly skip for the cookie-setting route
-        if ($request->path() === '_native/api/cookie') {
-            return $next($request);
-        }
-
         $cookie = $request->cookie('_php_native');
         $header = $request->header('X-NativePHP-Secret');
 
diff --git a/tests/Http/Controller/CreateSecurityCookieControllerTest.php b/tests/Http/Controller/CreateSecurityCookieControllerTest.php
deleted file mode 100644
index 33b17f1..0000000
--- a/tests/Http/Controller/CreateSecurityCookieControllerTest.php
+++ /dev/null
@@ -1,18 +0,0 @@
-<?php
-
-it('create security cookie', function () {
-    $response = $this->get('_native/api/cookie')->assertRedirect('/');
-    $cookie = $response->headers->getCookies()[0];
-
-    $this->assertEquals('_php_native', $cookie->getName());
-    $this->assertEquals('localhost', $cookie->getDomain());
-    $this->assertTrue($cookie->isHttpOnly());
-});
-
-it('check if secret is not equal of config secret key abort 403 page', function () {
-    config()->set('native-php.secret', 'milwad');
-
-    $response = $this->get('_native/api/cookie')->assertStatus(403);
-
-    $this->assertEquals([], $response->headers->getCookies());
-});