From 3cf44aa2ba38a2947a2ef2f974145a141ea5c2ea Mon Sep 17 00:00:00 2001
From: Juan Denis <jhd3197@gmail.com>
Date: Tue, 3 Nov 2026 13:10:27 -0500
Subject: [PATCH] fix(frontend): read the access token through storageKey in
 ServerGui

---
 SECURITY.md                                                 | 2 +-
 frontend/src/plugins/serverkit-gui/components/ServerGui.jsx | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index 769c50e5..b52a8b9c 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -142,7 +142,7 @@ silently.
 - **Tokens in `localStorage`.** The SPA keeps its JWT access/refresh tokens in
   `localStorage`, so an XSS bug would expose them. The production CSP now
   forbids inline and `eval` scripts (`script-src 'self'`) to reduce that risk;
-  a migration to `httpOnly` `SameSite` cookies is planned.
+  planned follow-up: move tokens to `httpOnly` `SameSite` cookies with CSRF protection.
 
 ## Extension Trust Model
 
diff --git a/frontend/src/plugins/serverkit-gui/components/ServerGui.jsx b/frontend/src/plugins/serverkit-gui/components/ServerGui.jsx
index 78b33011..b853baab 100644
--- a/frontend/src/plugins/serverkit-gui/components/ServerGui.jsx
+++ b/frontend/src/plugins/serverkit-gui/components/ServerGui.jsx
@@ -5,6 +5,7 @@ import { useEffect, useRef, useState, useCallback } from 'react';
 import { useTranslation, useFormat } from 'serverkit-sdk';
 import SyntheticDesktop from './SyntheticDesktop.jsx';
 import { Button as SharedButton } from 'serverkit-sdk';
+import { storageKey } from '../../../services/tunnelBase';
 
 const FRAME_INTERVAL_MS_DEFAULT = 700;
 const STORAGE_KEY = 'sk-gui:prefs';
@@ -52,7 +53,7 @@ export default function ServerGui({ api, serverId }) {
         if (api && typeof api.request === 'function') {
             return api.request(path);
         }
-        const token = localStorage.getItem('access_token');
+        const token = localStorage.getItem(storageKey('access_token'));
         const r = await fetch(path, { headers: token ? { Authorization: `Bearer ${token}` } : {} });
         if (!r.ok) throw new Error(`HTTP ${r.status}`);
         return r.json();