JWT Cookie

[matteioo]

The backend needs to return a HttpOnly cookie to handle authentication via a secure way so that the JWT access and refresh tokens are not accessible via XSS. The client then sends the cookie with every subsequent request to the backend, automatically authenticating the requests as long as the JWT is not expired.

[bresu]

Will look into this

[bresu]

Token pair creation works. How will the token be sent in the subsequent requests? In the form of a header? Need this so I can add it to the security middleware

[matteioo]

Due to the nature of HttpOnly cookies, the client is not able to extract the JWT token. Therefore, the token will be sent as a cookie with every request.

[bresu]

I think I implemented this correctly, please test so I can close this issue

[matteioo]

Cookie currently sent via HTTP header Authorization. Will look into it once the domains for FE + BE are cleared. Domains needed for Cookie context: domain so we can set it to Lax if they share the same domain differing by subdomain.