fix(ep-commerce): stop the shopper's EP token reaching the browser - #422

Merged

field123 merged 8 commits into

fix/ep-282-remove-browser-token-leak

Aug 14, 2026

Commits on Aug 13, 2026

fix(ep-commerce): stop serializing the shopper's EP token into page HTML
field123
committed
90a3f9e
chore(ep-commerce): trim comments and point the example app at local packages
field123
committed
efce78e
fix(ep-commerce): split inline type import for tsdx's TypeScript 3.9
field123
committed
6d64474
fix(ep-commerce): stop /get-session handing the EP token to the browser
field123
committed
a513b7c
fix(ep-commerce): withhold the whole session by allowlist, on every auth route
field123
committed
abbe293
fix(ep-commerce): make the session token independent of the readable user id
field123
committed
07c911b

Commits on Aug 14, 2026