New : JWT Cookie security #106

New : When logout remove cookie

src/Frontend/src/App.vue

@@ -17,7 +17,9 @@ watch(() => route.name, (newVal) => {
 
 const logout = () => {
   localStorage.removeItem('X-MiniAuth-Token')
+  document.cookie = 'X-MiniAuth-Token=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;'
   window.location.href = '/miniauth/login.html'
+  
 }
 
 const loadingFlag = ref(false)

src/MiniAuth/MiniAuthMiddleware.cs

@@ -129,7 +129,13 @@ public async Task Invoke(HttpContext context)
                                 var roles = user["roles"] as string[];
                                 var newToken = _jwtManager.GetToken(userName, userName, _options.ExpirationMinuteTime, roles);
                                 context.Response.Headers.Add("X-MiniAuth-Token", newToken);
-                                context.Response.Cookies.Append("X-MiniAuth-Token", newToken);
+                                context.Response.Cookies.Append("X-MiniAuth-Token", newToken, new CookieOptions
+                                {
+                                    Expires = DateTimeOffset.UtcNow.AddMinutes(_options.ExpirationMinuteTime),
+                                    HttpOnly = true,
+                                    Secure = true,
+                                    SameSite = SameSiteMode.Strict
+                                });
 
                                 await OkResult(context, $"{{\"X-MiniAuth-Token\":\"{newToken}\"}}").ConfigureAwait(false);
                                 return;

src/MiniAuth/wwwroot/assets/EndpointsView-Y1bxbe_m.css

@@ -0,0 +1 @@
+.resizable[data-v-5c19e2ea]{height:30px!important;transition:height .3s ease;overflow:hidden}.resizable[data-v-5c19e2ea]:hover{height:130px!important}

src/MiniAuth/wwwroot/assets/RolesView-dPFkXSBA.css

@@ -0,0 +1 @@
+input[type=text][data-v-3699460b],input[type=mail][data-v-3699460b]{widows:100%;border:0;border-bottom:2px solid black;outline:0;background-color:#e2e2e2be}