Security: Fix CSRF token not issued on login/register (Issue #756)

[sahare77]

Summary of What Has Been Done

The backend includes a CSRF protection middleware that expects a specific CSRF token cookie from the client. However, the server never actually issued this cookie upon login or session creation. As a result, endpoints requiring this CSRF check (like logout and oken refresh) were permanently unreachable and returned 403 Forbidden.

Changes Made

• Modified �ackend/controllers/authController.js to ensure the CSRF token is generated and sent as a cookie (csrfToken) during successful loginUser and
  egisterUser calls.

Impact it Made

• Fixes broken authentication flows (users can now successfully log out and refresh sessions).
• Successfully implements proper CSRF protection against cross-site request forgery attacks.

Closes #756

Summary

• Set a non-httpOnly csrfToken cookie after successful login and registration.
• Apply production-aware security settings and strict same-site behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6f00db35-2184-404a-a1eb-334c018db4cb

📥 Commits

Reviewing files that changed from the base of the PR and between 8acb5b8 and e9fbf68.

📒 Files selected for processing (1)

• backend/controllers/authController.js

---

📝 Walkthrough

Walkthrough

Registration and login now set a client-readable csrfToken cookie from res.locals._csrf before issuing the refresh-token cookie.

Changes

Authentication CSRF Flow

Layer / File(s)	Summary
CSRF cookie issuance backend/controllers/authController.js	Registration and login conditionally set the csrfToken cookie with production-aware security settings and strict same-site behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• #1430: Both changes issue the CSRF token cookie from backend/controllers/authController.js during authentication flows.

Suggested reviewers: karanunique, suhaniiz, prishajain64

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The change addresses CSRF cookie issuance during authentication, but does not implement the linked issue's middleware, frontend, logout, refresh, testing, or documentation requirements.	Implement or separately link the remaining CSRF middleware, frontend, logout, refresh, testing, and documentation requirements from issue #756.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the CSRF cookie fix for login and registration and references the linked issue.
Out of Scope Changes check	✅ Passed	The changes are limited to CSRF cookie issuance in the authentication controller and are related to issue #756.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thank you for your contribution!

To keep reviews manageable and maintain repository quality, contributors may have a maximum of 3 open Issues and 3 open Pull Requests at any given time.

Please wait until one of your existing submissions is reviewed or closed before opening additional ones.

If you believe this was closed by mistake, feel free to contact the maintainers.