Function installBearerAuthHeader

apps/desktop/src/main/index.ts:397–432

(origin: string, token: string | null)

};

const installBearerAuthHeader = (origin: string, token: string | null) => {
  authHeaderUnsubscribe?.();
  authHeaderUnsubscribe = null;
  if (!token) return;
  const headerValue = `Bearer ${token}`;
  session.defaultSession.webRequest.onBeforeSendHeaders(
    { urls: [`${origin}/*`] },
    (details, callback) => {
      // Scope the bearer to the app's OWN renderer. OAuth popups run in this same
      // session but load third-party provider pages; auto-attaching the bearer to
      // any request they make to the sidecar would make it an ambient credential
      // (a CSRF vector) for untrusted content — the very thing the bearer model
      // exists to avoid. The popup only ever needs the bearer-exempt
      // /oauth/callback and hands its result back via same-origin browser
      // channels (localStorage/postMessage), so withholding the bearer from any
      // non-app webContents is safe. Requests with no webContentsId (main
      // process / network service) still get it.
      const fromOtherWebContents =
        details.webContentsId !== undefined &&
        (mainWindow === null || details.webContentsId !== mainWindow.webContents.id);
      if (fromOtherWebContents) {
        callback({ requestHeaders: details.requestHeaders });
        return;
      }
      callback({
        requestHeaders: {
          ...details.requestHeaders,
          Authorization: headerValue,
        },
      });
    },
  );
  authHeaderUnsubscribe = () => {
    session.defaultSession.webRequest.onBeforeSendHeaders({ urls: [`${origin}/*`] }, null);
  };
};

/**
 * Resolve the on-disk path to the Executor app icon. Packaged builds get