Harden JWT cookies: add Secure and SameSite attributes via ResponseCookie

[coderabbitai]

Summary

The JWT cookie set in AuthViewController (and its logout/clear path) currently uses jakarta.servlet.http.Cookie without Secure or SameSite attributes. This should be hardened by replacing both cookie creation and cookie-clear paths with org.springframework.http.ResponseCookie builders.

Changes needed

Replace the jakarta.servlet.http.Cookie usage in src/main/java/org/example/alfs/controllers/AuthViewController.java with ResponseCookie:

import java.time.Duration;
import org.springframework.http.ResponseCookie;

// Set cookie on login:
ResponseCookie cookie = ResponseCookie.from("JWT", token)
        .httpOnly(true)
        .secure(true)
        .sameSite("Lax")
        .path("/")
        .maxAge(Duration.ofHours(24))
        .build();
response.addHeader("Set-Cookie", cookie.toString());

// Clear cookie on logout:
ResponseCookie cookie = ResponseCookie.from("JWT", "")
        .httpOnly(true)
        .secure(true)
        .sameSite("Lax")
        .path("/")
        .maxAge(Duration.ZERO)
        .build();
response.addHeader("Set-Cookie", cookie.toString());

Note: If local HTTP development (non-HTTPS) is needed, consider gating the secure(true) flag by Spring profile or environment variable.

References

• Flagged in PR feat: add UI authentication with cookie-based JWT support #18: feat: add UI authentication with cookie-based JWT support #18 (comment)
• Requested by @addee1

Why this matters

• Missing Secure flag: cookie can be transmitted over HTTP, exposing the JWT (CWE-614).
• Missing SameSite flag: leaves the app open to CSRF via cookie-based auth (CWE-352).