[P1.18] Stop putting long-lived JWTs in SSE/WebSocket URL query strings

[frankbria]

Severity: medium | Category: security | Phase: P1.18

Problem

SSE/WS auth appends the raw 24h JWT as ?token=.... Query strings are captured in uvicorn/reverse-proxy access logs and APM traces; a leaked log line grants a day-long session-takeover window.

Evidence

web-ui/src/lib/auth.ts:115, web-ui/src/hooks/useAgentChat.ts:132

Acceptance criteria

• Streams authenticate via a short-lived single-use ticket (from an authenticated POST) or a WS subprotocol/first-message auth frame — not the long-lived JWT in the URL.
• If deferred, proxies/servers scrub the token query param from logs and it is documented.

Dependencies

None

---

_{Filed from the SaaS launch-readiness audit. Atomic: one developer, one session. Work order: strictly P0.1 → P3.12 (no forward dependencies).}

[coderabbitai]

🔗 Related PRs

#709 - fix(security): shorten JWT lifetime to 24h + add web-UI CSP (#657) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!