Enhance JWT handling: set token as HttpOnly cookie for secure authentication and implement logout functionality

Author: batdimoiprint

Configurations/SecurityConfiguration.cs

@@ -3,6 +3,8 @@
 using Microsoft.Extensions.Hosting;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.IdentityModel.Tokens;
+using Microsoft.AspNetCore.Http;
+using System.Threading.Tasks;
 using System.Text;
 
 namespace Flowboard_Project_Management_System_Backend.Configurations
@@ -21,15 +23,23 @@ public static IServiceCollection AddFrontendCors(this IServiceCollection service
                 {
                     if (environment.IsDevelopment())
                     {
-                        policy.AllowAnyOrigin()
+                        // In development allow all origins but allow credentials, so we reflect the origin
+                        // with SetIsOriginAllowed. Avoid AllowAnyOrigin together with AllowCredentials.
+                        policy.SetIsOriginAllowed(_ => true)
                               .AllowAnyHeader()
-                              .AllowAnyMethod();
+                              .AllowAnyMethod()
+                              .AllowCredentials();
                     }
                     else
                     {
-                        policy.WithOrigins(productionFrontendOrigin)
-                              .AllowAnyHeader()
-                              .AllowAnyMethod();
+                        // In production only allow configured frontend origin and credentials
+                        if (!string.IsNullOrWhiteSpace(productionFrontendOrigin))
+                        {
+                            policy.WithOrigins(productionFrontendOrigin)
+                                  .AllowAnyHeader()
+                                  .AllowAnyMethod()
+                                  .AllowCredentials();
+                        }
                     }
                 });
             });
@@ -63,6 +73,23 @@ public static IServiceCollection AddJwtAuthentication(this IServiceCollection se
                     ValidAudience = jwtAudience,
                     IssuerSigningKey = new SymmetricSecurityKey(keyBytes)
                 };
+
+                // Allow reading token from an HttpOnly cookie named "jwt" if present
+                options.Events = new JwtBearerEvents
+                {
+                    OnMessageReceived = context =>
+                    {
+                        if (string.IsNullOrEmpty(context.Token))
+                        {
+                            // Try reading from the cookie
+                            if (context.Request.Cookies.TryGetValue("jwt", out var cookieToken) && !string.IsNullOrEmpty(cookieToken))
+                            {
+                                context.Token = cookieToken;
+                            }
+                        }
+                        return Task.CompletedTask;
+                    }
+                };
             });
 
             // Register Authorization as well, so callers don't have to explicitly add it

Controllers/PublicController.cs

@@ -2,6 +2,7 @@
 using Flowboard_Project_Management_System_Backend.Services;
 using MongoDB.Driver;
 using Microsoft.IdentityModel.Tokens;
+using Microsoft.AspNetCore.Http;
 using System.IdentityModel.Tokens.Jwt;
 using System.Security.Claims;
 using System.Text;
@@ -13,10 +14,12 @@
 public class PublicController : ControllerBase
 {
     private readonly MongoDbService _mongoDbService;
+    private readonly IHostEnvironment _env;
 
-    public PublicController(MongoDbService mongoDbService)
+    public PublicController(MongoDbService mongoDbService, IHostEnvironment environment)
     {
         _mongoDbService = mongoDbService;
+        _env = environment;
     }
 
     [HttpPost("register")]
@@ -79,14 +82,44 @@ public IActionResult Login([FromBody] FlowModels.LoginRequest loginRequest)
         // Generate JWT token
         var token = GenerateJwtToken(user);
 
+        // Set JWT as HttpOnly cookie for automatic browser authentication
+        var expiryMinutes = int.Parse(Environment.GetEnvironmentVariable("JWT_EXPIRY_MINUTES") ?? "60");
+        var cookieOptions = new CookieOptions
+        {
+            HttpOnly = true,
+            Secure = !_env.IsDevelopment(), // Secure cookie in production
+            SameSite = _env.IsDevelopment() ? SameSiteMode.Lax : SameSiteMode.None,
+            Expires = DateTime.UtcNow.AddMinutes(expiryMinutes),
+            Path = "/"
+        };
+
+        Response.Cookies.Append("jwt", token, cookieOptions);
+
         return Ok(new
         {
             message = "Login successful!",
             user,
-            token
+            
         });
     }
 
+    [HttpPost("logout")]
+    public IActionResult Logout()
+    {
+        // Remove cookie by setting expired options
+        var cookieOptions = new CookieOptions
+        {
+            HttpOnly = true,
+            // Secure = !_env.IsDevelopment(),
+            Secure = _env.IsDevelopment(),
+            SameSite = _env.IsDevelopment() ? SameSiteMode.Lax : SameSiteMode.None,
+            Expires = DateTime.UtcNow.AddDays(-1),
+            Path = "/"
+        };
+        Response.Cookies.Delete("jwt", cookieOptions);
+        return Ok(new { message = "Logout successful" });
+    }
+
         // ---------------- JWT Helper ----------------
     private string GenerateJwtToken(FlowModels.User user)
     {