fix(ui): store SSO exchange token via storeLoginToken to keep Secure flag (#45840)

Co-authored-by: Nabil Ameena <nabilaameena@users.noreply.github.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ui/litellm-dashboard/src/components/networking.test.ts

@@ -118,6 +118,40 @@ describe("loginCall - storeLoginToken integration", () => {
   });
 });
 
+describe("exchangeLoginCode - storeLoginToken integration", () => {
+  const originalFetch = global.fetch;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  afterEach(() => {
+    global.fetch = originalFetch;
+  });
+
+  it("calls storeLoginToken when exchange response includes token", async () => {
+    global.fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({ token: "sso-jwt" }),
+    }) as unknown as typeof global.fetch;
+    const { storeLoginToken } = await import("@/utils/cookieUtils");
+    const token = await Networking.exchangeLoginCode("some-login-code");
+    expect(token).toBe("sso-jwt");
+    expect(storeLoginToken).toHaveBeenCalledWith("sso-jwt");
+  });
+
+  it("does not call storeLoginToken when exchange response has no token", async () => {
+    global.fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({}),
+    }) as unknown as typeof global.fetch;
+    const { storeLoginToken } = await import("@/utils/cookieUtils");
+    const token = await Networking.exchangeLoginCode("some-login-code");
+    expect(token).toBeUndefined();
+    expect(storeLoginToken).not.toHaveBeenCalled();
+  });
+});
+
 describe("modelInfoCall", () => {
   let currentFetch: typeof global.fetch;
 

ui/litellm-dashboard/src/components/networking.tsx

@@ -7102,7 +7102,7 @@ export const exchangeLoginCode = async (code: string, workerBaseUrl?: string | n
 
   const data = await response.json();
   if (data.token) {
-    document.cookie = `token=${data.token}; path=/; SameSite=Lax`;
+    storeLoginToken(data.token);
   }
   return data.token;
 };

ui/litellm-dashboard/src/utils/cookieUtils.test.ts

@@ -174,6 +174,29 @@ describe("cookieUtils", () => {
       expect(cookieSpy).toHaveBeenCalledWith(expect.stringContaining("path=/ui"));
       vi.restoreAllMocks();
     });
+
+    it("should write the cookie with Secure on an https page", () => {
+      vi.stubGlobal("location", { ...window.location, protocol: "https:" });
+      const cookieSpy = vi.spyOn(document, "cookie", "set");
+
+      storeLoginToken("https-jwt");
+
+      expect(cookieSpy).toHaveBeenCalledWith(expect.stringMatching(/^token=https-jwt; .*; Secure$/));
+      vi.unstubAllGlobals();
+      vi.restoreAllMocks();
+    });
+
+    it("should write the cookie without Secure on an http page", () => {
+      vi.stubGlobal("location", { ...window.location, protocol: "http:" });
+      const cookieSpy = vi.spyOn(document, "cookie", "set");
+
+      storeLoginToken("http-jwt");
+
+      expect(cookieSpy).toHaveBeenCalledWith(expect.stringMatching(/^token=http-jwt; /));
+      expect(cookieSpy).not.toHaveBeenCalledWith(expect.stringContaining("Secure"));
+      vi.unstubAllGlobals();
+      vi.restoreAllMocks();
+    });
   });
 
   describe("getCookie", () => {