Yookr Logo

Authentication & Security

Learn how the dashboard handles security and sessions.

This guide explains how users and automated workers authenticate with the Prediction System.

Table of Contents

User Authentication

Users log into the dashboard using standard email and password credentials. The frontend handles the handshake and stores a secure, HttpOnly, Secure cookie in your browser. This session is proactive and stateless, meaning it is verified on every request by our edge middleware.

Machine-to-Machine (Worker) Login

For automated prediction workers or scripts, the system provides a specialized login flow that uses job-specific credentials.

  • Endpoint: POST /serviceLogin
  • Identity: Authenticates using the Source Version ID (service_id) and its generated password.
  • Session: Upon success, the server issues a standard security cookie. Automated scripts should use a "cookie jar" (like requests.Session in Python) to maintain this session for subsequent API calls.

Security Practices

  • Cookie Hardening: We strictly use HttpOnly, Secure, and SameSite=Lax attributes. This prevents client-side scripts from accessing your session tokens, effectively neutralizing most XSS-based session theft.
  • No Sensitive Data in LocalStorage: We deliberately avoid storing cryptographic material in localStorage or anywhere reachable by the WebStorage API.
  • Permissiveness at the Edge: Every request is intercepted and validated via Zod-based schema inspection and JWT role assertions before reaching the backend database.

Technical Architecture (Middleware)

Inside the system, authentication is handled as a proactive, stateless flow:

1. Middleware Execution: The middleware.ts intercepts every request. It decodes the structure of the authentication cookie and ensures the signature is valid before allowing the request to proceed to the React or API layers. 2. Server Action Boundary: Inside Next.js, we use dedicated action modules to mutate the cookieStore. This ensures that logins and logouts happen atomically and are immediately reflected in the server context.