fix: Forward Set-Cookie and strip Bearer token

frontend/app/api/[...path]/route.ts

@@ -116,6 +116,11 @@ async function proxyRequest(request: NextRequest, params: { path: string[] }) {
       }
     }
 
+    // Explicitly forward Set-Cookie headers (entries() may omit them)
+    for (const cookie of response.headers.getSetCookie()) {
+      responseHeaders.append("set-cookie", cookie);
+    }
+
     // For streaming responses, pass the body directly without buffering
     if (response.body) {
       return new NextResponse(response.body, {

src/session_manager.py

@@ -217,8 +217,9 @@ def create_jwt_token(self, user: User) -> str:
     def verify_token(self, token: str) -> Optional[Dict[str, Any]]:
         """Verify JWT token and return user info"""
         try:
+            raw = token.removeprefix("Bearer ")
             payload = jwt.decode(
-                token,
+                raw,
                 self.public_key,
                 algorithms=[self.algorithm],
                 audience=["opensearch", "openrag"],