Fix/fix token error

[VishnuPScodes]

User description

<img width="1024" height="1024" alt="ChatGPT Image Jul 30, 2025, 11_42_55 AM (1)" src="https://github.com/user-attachments/assets/c63227ad-8fa9-4859-

ba6e-a0354a9a07ec" />

---

PR Type

Bug fix, Enhancement

---

Description

• Implement cookie-based authentication to replace header tokens

• Add cookie-parser middleware for secure token handling

• Update login/register responses to include access tokens

• Fix authentication flow with proper Redux token dispatch

---

Diagram Walkthrough

flowchart LR
  A["Client Login/Register"] --> B["Server Auth Controller"]
  B --> C["Set HTTP-Only Cookie"]
  B --> D["Return Token in Response"]
  D --> E["Redux Store Token"]
  F["Protected Routes"] --> G["Cookie Authentication"]
  G --> H["Verify JWT Token"]

Loading

File Walkthrough

	Relevant files
Configuration changes	index.js Add cookie middleware and CORS credentials                              Back-end/index.js Add cookie-parser middleware for cookie handling Configure CORS to allow credentials for cookie support Remove commented legacy controller imports +8/-14
Enhancement	auth.controller.js Implement cookie-based token management                                    Back-end/src/controllers/auth/auth.controller.js Set HTTP-only cookies for access tokens in register/login Include access token in response body for both endpoints Update login response format to match registration Remove debug console.log from loginUser +8/-2      Reg.jsx Add Redux token dispatch on registration                                  front-end/src/pages/Auth/Reg.jsx Import addToken action for Redux token management Dispatch token to Redux store after successful registration Extract token from registration response +4/-1
Bug fix	authenticate.js Switch from header to cookie authentication                            Back-end/src/middlewares/auth/authenticate.js Replace header-based authentication with cookie extraction Remove Bearer token validation logic Extract token from req.cookies.access_token Update error handling and formatting +4/-20
Dependencies	package.json Add cookie-parser dependency                                                          Back-end/package.json Add cookie-parser dependency for cookie handling +1/-0

---

[codiumai-pr-agent-free]

PR Reviewer Guide 🔍

(Review updated until commit 8493ea1)

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Duplicate CORS The PR adds a new CORS configuration with credentials support but keeps the old CORS middleware, which could cause conflicts or unexpected behavior. app.use( cors({ credentials: true, // Allow credentials (cookies) }) ); app.use(express.json()); //prevent the cors errors app.use(cors()); Missing Error Handling The authentication middleware catches errors but doesn't return after sending the error response, allowing execution to continue to next() even after authentication failure. } catch (error) { res.status(400).send({ message: "Authorization token was not provided" }); } Debug Code There's a console.log statement that should be removed before merging to production. console.log({ accessToken });

The managed version of the open source project PR-Agent is sunsetting on the 1st December 2025. The commercial version of this project will remain available and free to use as a hosted service. Install Qodo.

[codiumai-pr-agent-free]

PR Code Suggestions ✨

Latest suggestions up to 8493ea1

Category	Suggestion	Impact
Possible issue	Remove duplicate CORS middleware Remove the duplicate app.use(cors()) call in index.js. The second call overrides the first one, which is configured to allow credentials, and will break cookie-based authentication. Back-end/index.js [15-24] app.use( cors({ credentials: true, // Allow credentials (cookies) + origin: true, // Reflect the request origin or use specific origins }) ); app.use(express.json()); //prevent the cors errors -app.use(cors()); - Apply / Chat Suggestion importance[1-10]: 9 __ Why: This suggestion correctly identifies a critical bug where the second app.use(cors()) call overrides the first, disabling the credentials: true option, which would break the cookie-based authentication introduced in this PR.	High
	Add token fallback mechanism Add a fallback mechanism in the authentication middleware to check for the token in the Authorization header if it's not found in cookies. This will ensure backward compatibility for existing clients. Back-end/src/middlewares/auth/authenticate.js [16-17] -const token = req.cookies?.access_token; +// Try to get token from cookies first, then from Authorization header +let token = req.cookies?.access_token; + +// Fallback to Authorization header if cookie is not present +if (!token && req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) { + token = req.headers.authorization.split(' ')[1]; +} + console.log({ token, cookies: req.cookies }); Apply / Chat Suggestion importance[1-10]: 6 __ Why: The suggestion correctly points out that removing the Authorization header logic is a breaking change. Proposing a fallback improves backward compatibility, making the API more robust during a transition period.	Low
Security	Add sameSite cookie attribute Add the sameSite attribute to the access token cookie. This is necessary for modern browsers to send cookies in cross-origin requests, especially when the secure attribute is used. Back-end/src/controllers/auth/auth.controller.js [23-26] res.cookie("access_token", accessToken, { httpOnly: true, secure: process.env.NODE_ENV === "production", + sameSite: process.env.NODE_ENV === "production" ? 'none' : 'lax', }); [To ensure code accuracy, apply this suggestion manually] Suggestion importance[1-10]: 8 __ Why: This suggestion addresses a crucial aspect of cross-origin cookie handling. Modern browsers enforce sameSite policies, and omitting this attribute would likely cause the cookie-based authentication to fail in production, making this a high-impact fix.	Medium
More

The managed version of the open source project PR-Agent is sunsetting on the 1st December 2025. The commercial version of this project will remain available and free to use as a hosted service. Install Qodo.

---

Previous suggestions

Suggestions

Category	Suggestion	Impact
Possible issue	Fix CORS configuration override The second call to app.use(cors()) overrides the first CORS configuration with credentials support. Remove the second call to ensure cookies are properly handled across origins. Back-end/index.js [15-24] app.use( cors({ credentials: true, // Allow credentials (cookies) }) ); app.use(express.json()); //prevent the cors errors -app.use(cors()); - Suggestion importance[1-10]: 10 __ Why: The suggestion correctly identifies that the second app.use(cors()) call overrides the first, which would break the cookie-based authentication introduced in the PR.	High
	Add required CORS origin The CORS configuration is missing the origin property, which is required when using credentials: true. Add the appropriate origin to ensure proper cross-origin requests with cookies. Back-end/index.js [15-19] app.use( cors({ + origin: process.env.FRONTEND_URL || "http://localhost:3000", credentials: true, // Allow credentials (cookies) }) ); Suggestion importance[1-10]: 10 __ Why: The suggestion correctly points out that setting credentials: true requires a specific origin for CORS, and omitting it would break the functionality added in the PR.	High
Security	Remove sensitive data logging Remove the debug console.log statement that exposes the access token. Logging sensitive security tokens is a security risk in production environments. Back-end/src/controllers/auth/auth.controller.js [40-41] const { accessToken, user } = loginResponse; -console.log({ accessToken }); Suggestion importance[1-10]: 9 __ Why: The suggestion correctly identifies a security risk by pointing out that a sensitive accessToken is being logged, which should be removed before deploying to production.	High

[VishnuPScodes]

/review
-i
--pr_reviewer.num_code_suggestions="0"

[codiumai-pr-agent-free]

Persistent review updated to latest commit 8493ea1

[VishnuPScodes]

/improve
--pr_code_suggestions.extra_instructions="
Emphasize the following:

• Does the code logic cover relevant edge cases?
• Is the code logic clear and easy to understand?
• Is the code logic efficient?

"
--pr_code_suggestions.num_code_suggestions_per_chunk="4"

[codiumai-pr-agent-free]

Persistent suggestions updated to latest commit 8493ea1