fix(ws): cookie-first auth, fall back to token only on 4001

The WS client always appended ?token=<bearer> to the URL, but the
server rejects query-token auth by default (WS_QUERY_TOKEN_ENABLED is
false). The httpOnly session cookie was already attached to the
handshake by the browser — cookie auth would have worked, the client
just never gave it a chance. Result: every connection rejected, "WS
Connection timeout" loop in dev tools.

- public/js/ws.js: prefer cookie-only on first attempt. If close 4001
  AND a Bearer token exists, retry once with token-in-query. Reset
  on successful open so a rotated token is re-tried correctly.

Also adds an inline "Update available" banner to the What's New page
header (between title and version+GitHub controls — same row, no
header growth) per user request.

Release: v7.3.5

Author: bogdanpricop

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to Docker Dash are documented here.
 
+## [7.3.5] - 2026-04-25 — WS cookie-first auth + What's New update banner
+
+### Fixed
+
+- **WebSocket connection failures** (rejected by server with `WS rejected: query token auth disabled`). The client always appended `?token=<bearer>` to the WS URL, but the server rejects query-token auth by default for security (set `WS_QUERY_TOKEN_ENABLED=true` to allow). The session cookie (httpOnly `dd_sid`) was already attached to the WS handshake by the browser, so cookie auth would have worked — the client just never gave it a chance.
+
+  Now the client tries **cookie-only first**. Only if that closes with code 4001 (auth failed) AND a Bearer token is in `sessionStorage` does it fall back to token-in-query for one retry. This keeps the security default intact for everyone using cookies, while preserving the fallback for browsers that block them (Edge Tracking Prevention etc.). Reset to cookie-first on every successful open so a rotated token gets re-tried correctly. ([public/js/ws.js:6-25, 44-56, 68-91](public/js/ws.js))
+
+### Added
+
+- **Inline "Update available" banner** in the What's New page header. When `UpdateNotifier._state.hasUpdate === true`, a small accent-colored chip appears between the H2 and the version+GitHub controls — same row, no header growth. Click → opens the same release-notes modal as the sidebar badge. Hidden when up-to-date or feature disabled. ([public/js/pages/whatsnew.js:1369-1418](public/js/pages/whatsnew.js))
+
 ## [7.3.3] - 2026-04-25 — System → Updates surfaces app updates too
 
 The v7.3.0 update notifier was reachable from the sidebar badge and System Settings → General — but **not** from System → Updates, which is the page users naturally reach for "is there an update for X?" That page only checked Docker Engine + OS updates, with the Docker Dash row showing only the running version (no comparison to GitHub latest).

docker-compose.yml

@@ -4,8 +4,8 @@ services:
       context: .
       dockerfile: Dockerfile
       args:
-        APP_VERSION: "${APP_VERSION:-7.3.3}"
-    image: docker-dash:${APP_VERSION:-7.3.3}
+        APP_VERSION: "${APP_VERSION:-7.3.5}"
+    image: docker-dash:${APP_VERSION:-7.3.5}
     container_name: docker-dash
     restart: unless-stopped
     env_file:
@@ -54,7 +54,7 @@ services:
   dd-egress-filter:
     build:
       context: ./docker/egress-filter
-    image: docker-dash-egress-filter:${APP_VERSION:-7.3.3}
+    image: docker-dash-egress-filter:${APP_VERSION:-7.3.5}
     container_name: dd-egress-filter
     restart: unless-stopped
     # Uses the default bridge so target containers on the default bridge can

package.json

@@ -1,6 +1,6 @@
 {
   "name": "docker-dash",
-  "version": "7.3.3",
+  "version": "7.3.5",
   "description": "Full-featured Docker management dashboard",
   "main": "src/server.js",
   "scripts": {

public/js/pages/whatsnew.js

@@ -9,6 +9,15 @@ const WhatsNewPage = {
   // Add new releases at the TOP of this array.
   // Types: feature, fix, improvement, security, breaking
   _releases: [
+    {
+      version: '7.3.5',
+      date: '2026-04-25',
+      title: 'WS cookie-first auth + What\'s New update banner',
+      changes: [
+        { type: 'fix', text: 'WebSocket failed to connect ("WS rejected: query token auth disabled" in server logs). The client always appended ?token=<bearer> to the WS URL, but the server rejects query-token auth by default for security. The session cookie (httpOnly dd_sid) was already attached to the WS handshake by the browser — cookie auth would have worked, the client just never tried it that way. Now: cookie-only first, fall back to token-in-query only after 4001. Reset on every successful open so token rotations get re-tried.' },
+        { type: 'feature', text: 'When a newer release is available on GitHub, the What\'s New page header shows a small accent-colored "Update available: vX.Y.Z" chip between the title and the version/GitHub controls. Same row, no header growth. Click → opens the release-notes modal.' },
+      ],
+    },
     {
       version: '7.3.3',
       date: '2026-04-25',
@@ -1372,7 +1381,8 @@ const WhatsNewPage = {
     container.innerHTML = `
       <div class="page-header">
         <h2><i class="fas fa-bullhorn"></i> What's New</h2>
-        <div class="page-actions">
+        <span id="whatsnew-update-banner" style="display:none;margin:0 12px;flex:0 0 auto"></span>
+        <div class="page-actions" style="margin-left:auto">
           <span class="badge badge-info" style="font-size:12px">v${Utils.escapeHtml(current)}</span>
           <a href="https://github.com/bogdanpricop/docker-dash" target="_blank" rel="noopener" class="btn btn-sm btn-secondary" style="display:inline-flex;align-items:center;gap:6px;text-decoration:none">
             <i class="fab fa-github"></i> GitHub
@@ -1381,6 +1391,38 @@ const WhatsNewPage = {
       </div>
       <div id="whatsnew-content">${this._renderReleases()}</div>
     `;
+
+    // v7.3.5: render an inline "Update available" banner in the header when
+    // a newer release exists on GitHub. Sized to fit on the same row as the
+    // existing controls so the header height doesn't grow.
+    this._renderUpdateBanner();
+  },
+
+  async _renderUpdateBanner() {
+    const slot = document.getElementById('whatsnew-update-banner');
+    if (!slot) return;
+    let state = window.UpdateNotifier?._state;
+    // If notifier hasn't run yet (rare, since app.js inits it on startup),
+    // fetch on-demand so the banner doesn't stay empty.
+    if (!state) {
+      try { await window.UpdateNotifier?.init(); state = window.UpdateNotifier?._state; }
+      catch { return; }
+    }
+    if (!state || !state.hasUpdate) return;
+    slot.style.display = 'inline-flex';
+    slot.style.alignItems = 'center';
+    slot.style.gap = '6px';
+    slot.style.padding = '4px 10px';
+    slot.style.borderRadius = 'var(--radius-sm)';
+    slot.style.background = 'rgba(56,139,253,0.12)';
+    slot.style.color = 'var(--accent)';
+    slot.style.fontSize = '12px';
+    slot.style.fontWeight = '600';
+    slot.style.cursor = 'pointer';
+    slot.style.lineHeight = '1';
+    slot.title = i18n.t('updates.badgeTooltip', { version: state.latest });
+    slot.innerHTML = `<i class="fas fa-arrow-up" style="font-size:10px"></i> ${i18n.t('updates.modalTitle')}: ${Utils.escapeHtml(state.latest)}`;
+    slot.addEventListener('click', () => window.UpdateNotifier?.openModal());
   },
 
   _renderReleases() {

public/js/ws.js

@@ -12,15 +12,20 @@ const WS = {
   _subscriptions: new Set(),
   _connected: false,
   _intentionalClose: false,
+  _useTokenFallback: false,  // v7.3.5: only true after a cookie-only attempt failed with 4001
 
   connect() {
     if (this._ws && this._ws.readyState <= 1) return;
     this._intentionalClose = false;
 
     const proto = location.protocol === 'https:' ? 'wss:' : 'ws:';
-    // Pass Bearer token as query param for when cookies are blocked
+    // v7.3.5: prefer cookie auth (the session cookie is httpOnly so JS can't
+    // probe it — browser attaches it automatically on the WS handshake).
+    // The server rejects ?token= unless WS_QUERY_TOKEN_ENABLED=true is set,
+    // and that's off by default for security (tokens can leak via logs/refer).
+    // Only fall back to token-in-query after a cookie attempt closes 4001.
     const token = Api?._bearerToken || '';
-    const url = token
+    const url = (this._useTokenFallback && token)
       ? `${proto}//${location.host}/ws?token=${encodeURIComponent(token)}`
       : `${proto}//${location.host}/ws`;
 
@@ -44,6 +49,9 @@ const WS = {
       clearTimeout(connectTimeout);
       this._connected = true;
       this._reconnectDelay = 1000;
+      // v7.3.5: cookie auth worked — clear the fallback flag so future
+      // reconnects also try cookie-first (in case token rotated).
+      this._useTokenFallback = false;
       if (window._ddDebug) console.log('[WS] Connected');
       this._emit('_connected');
       // Re-subscribe channels
@@ -67,12 +75,25 @@ const WS = {
       this._connected = false;
       if (window._ddDebug) console.log('[WS] Disconnected', evt.code);
       this._emit('_disconnected');
-      if (!this._intentionalClose && evt.code !== 4001) {
-        this._scheduleReconnect();
-      }
       if (evt.code === 4001) {
-        // Auth failure
+        // v7.3.5: cookie auth failed. If we haven't tried token-in-query yet
+        // and we have a Bearer token, retry once with the fallback. This
+        // handles browsers that block the session cookie (e.g. strict
+        // tracking prevention). Only flip + retry if the user is still
+        // authenticated as far as the API is concerned.
+        if (!this._useTokenFallback && Api?._bearerToken && !this._intentionalClose) {
+          this._useTokenFallback = true;
+          if (window._ddDebug) console.log('[WS] Cookie auth rejected, retrying with token fallback');
+          this._scheduleReconnect();
+          return;
+        }
+        // Either we already tried both modes, or we have no token to try.
+        // Real auth failure — bounce to login (idempotent in v7.3.1+).
         if (typeof App !== 'undefined') App.handleUnauthorized();
+        return;
+      }
+      if (!this._intentionalClose) {
+        this._scheduleReconnect();
       }
     };
 

src/version.js

@@ -2,4 +2,4 @@
 // Single source of truth for the application version.
 // Updated automatically by: npm version X.Y.Z  (via scripts/sync-version.js)
 // server.js reads this to inject into index.html at startup — no build step needed.
-module.exports = '7.3.3';
+module.exports = '7.3.5';