security: clear login token from URL and add headers

[dobby-coder]

A security review found code-level issues (dep CVEs handled by the existing dependency issue). Draft advisory with full details: https://github.com/privacybydesign/irma_keyshare_webclient/security/advisories/GHSA-6x7w-pr2c-9g35

Please implement the fixes and open a draft PR linked to the advisory.

[dobby-coder]

/dobby fix — Implement the fixes from advisory https://github.com/privacybydesign/irma_keyshare_webclient/security/advisories/GHSA-6x7w-pr2c-9g35: (1) in src/index.tsx (~lines 15-31), after consuming a #token=/#verify= fragment clear it via history.replaceState(null, '', location.pathname + location.search) and guard the hashchange listener so it can't re-dispatch a login when already authenticated; (2) in src/store/index.ts + src/components/error_message/index.tsx, map errors to i18n keys instead of rendering error.toString() (raw detail to console only); (3) add a static-web-server config to the Docker image setting CSP + X-Frame-Options + X-Content-Type-Options + Referrer-Policy. Build + run tests, open a draft PR linked to the advisory.

[dobby-coder]

Dobby hit a rate limit mid-task and had to pause. Resets 02 Jul 2026, 08:29 CEST. I'll automatically resume where I left off — no work lost!

[dobby-coder]

Dobby hit a rate limit mid-task and had to pause. Resets 02 Jul 2026, 09:30 CEST. I'll automatically resume where I left off — no work lost!

[dobby-coder]

/dobby

[dobby-coder]

/dobby fix — resume the stalled fix for advisory GHSA-6x7w-pr2c-9g35 in irma_keyshare_webclient. In src/index.tsx (~lines 15-31), after consuming the #token=/verification value from window.location.hash, strip it from the address bar via history.replaceState so the login/verification token is not left in the URL or browser history. Also add the security response headers described in the advisory. Open a draft PR linked to the advisory and run the build/tests before submitting.