Add Authentication(Cookie Based)

[MojtabaOnTheNet]

Add Cookie-Based Authentication

Implement a secure cookie-based authentication system for the application.

Features

• User authentication using HTTP-only cookies
• Secure session handling without exposing tokens to the client-side JavaScript
• Access token management via cookies

Token Strategy

• Implement short-lived access tokens
• Implement refresh tokens for session renewal without requiring re-login
• Secure storage of refresh tokens (preferably HTTP-only, Secure, SameSite cookies)

Functionality

• Login

  • Authenticate user credentials
  • Issue access + refresh tokens
  • Store tokens in secure cookies

• Refresh Token Flow

  • Automatically issue new access tokens using a valid refresh token
  • Prevent frequent re-authentication

• Logout

  • Invalidate refresh token
  • Clear authentication cookies from client
  • Ensure session is fully terminated on both client and server

Security Considerations

• Use HTTP-only cookies to prevent XSS attacks
• Enable Secure flag in production (HTTPS only)
• Apply SameSite policies to prevent CSRF
• Rotate refresh tokens to improve security