From 11974cae354237bf473f515ab171117136653745 Mon Sep 17 00:00:00 2001
From: Hendrik Jaks <hendrikjaks@gmail.com>
Date: Fri, 20 Mar 2026 00:19:48 +0200
Subject: [PATCH] fix(ui): harden getUiCookiePath regex and add missing tests

- Use regex /\/ui(?=\/|$)/ to match "/ui" only as a full path segment,
  preventing false matches on paths like "/my-ui-tool/login".
- Add unit tests for storeLoginToken empty/whitespace guard and
  cookie-at-/ui-path behavior.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../src/utils/cookieUtils.test.ts             | 19 +++++++++++++++++++
 ui/litellm-dashboard/src/utils/cookieUtils.ts |  8 ++++++--
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/ui/litellm-dashboard/src/utils/cookieUtils.test.ts b/ui/litellm-dashboard/src/utils/cookieUtils.test.ts
index d7418db3178..c7bd27a6a85 100644
--- a/ui/litellm-dashboard/src/utils/cookieUtils.test.ts
+++ b/ui/litellm-dashboard/src/utils/cookieUtils.test.ts
@@ -147,6 +147,25 @@ describe("cookieUtils", () => {
 
       global.window = originalWindow;
     });
+
+    it("should not store empty string token", () => {
+      storeLoginToken("");
+      expect(sessionStorage.getItem("token")).toBeNull();
+    });
+
+    it("should not store whitespace-only token", () => {
+      storeLoginToken("   ");
+      expect(sessionStorage.getItem("token")).toBeNull();
+    });
+
+    it("should set a JS-accessible cookie at /ui path", () => {
+      const cookieSpy = vi.spyOn(document, "cookie", "set");
+      storeLoginToken("my-jwt-token");
+      expect(cookieSpy).toHaveBeenCalledWith(
+        expect.stringContaining("path=/ui")
+      );
+      vi.restoreAllMocks();
+    });
   });
 
   describe("getCookie", () => {
diff --git a/ui/litellm-dashboard/src/utils/cookieUtils.ts b/ui/litellm-dashboard/src/utils/cookieUtils.ts
index 583f41e84a8..b4493744ad4 100644
--- a/ui/litellm-dashboard/src/utils/cookieUtils.ts
+++ b/ui/litellm-dashboard/src/utils/cookieUtils.ts
@@ -10,8 +10,12 @@
  */
 function getUiCookiePath(): string {
   if (typeof window === "undefined") return "/ui";
-  const idx = window.location.pathname.indexOf("/ui");
-  if (idx >= 0) return window.location.pathname.substring(0, idx + 3);
+  // Match "/ui" only as a full path segment (followed by "/" or end of string)
+  // to avoid false matches like "/my-ui-tool/login" → "/my-ui".
+  const match = window.location.pathname.match(/\/ui(?=\/|$)/);
+  if (match && match.index !== undefined) {
+    return window.location.pathname.substring(0, match.index + 3);
+  }
   return "/ui";
 }