dev - migração localStorage → httpOnly cookie

[icrcode]

This pull request implements a major change in how authentication is handled across both the backend and frontend. The system now uses HTTP-only cookies to store authentication tokens instead of localStorage and Authorization headers. This improves security by protecting tokens from XSS attacks and simplifies session management. The backend sets and clears the cookie, and the frontend no longer manages or sends tokens explicitly. Additionally, several new endpoints and utilities were added to support cookie-based authentication.

Key changes include:

Backend: Migration to Cookie-based Authentication

• Added cookie-parser middleware and its types to parse cookies in Express, and updated authentication middleware to extract JWT tokens from the valida_token cookie instead of the Authorization header. (backend/package.json, backend/package-lock.json, backend/src/aplicativo.ts, backend/src/middleware/autenticacao.ts) [1] [2] [3] [4] [5] [6] [7] [8] [9]

• Updated authentication routes to set the JWT as an HTTP-only cookie on login and registration, and to clear it on logout. Also added /me and /logout endpoints for session management. (backend/src/modulos/auth/rotas.ts) [1] [2] [3] [4] [5]

Frontend: Removal of Token Management and API Adjustments

• Removed all logic related to storing, retrieving, and sending tokens in localStorage and Authorization headers. API requests now use withCredentials: true to send cookies automatically. (frontend/src/contexts/AuthContext.tsx, frontend/src/services/api.ts, frontend/src/services/auth.ts, frontend/src/pages/Login.tsx, frontend/src/pages/Cadastro.tsx, frontend/src/pages/Perfil.tsx) [1] [2] [3] [4] [5] [6] [7] [8] [9]

• Updated authentication context and related components to only manage user information, not tokens. Login/logout flows now interact with the backend for session management and no longer rely on local token storage. (frontend/src/contexts/AuthContext.tsx, frontend/src/services/auth.ts) [1] [2] [3] [4]

Testing and Helpers Updates

• Adjusted tests and test helpers to reflect the removal of token management in localStorage and to mock the new API behavior. (frontend/src/test/contexts/AuthContext.test.tsx, frontend/src/test/helpers/renderWithProviders.tsx) [1] [2] [3] [4] [5]

These changes collectively modernize and secure the authentication flow, moving all sensitive token handling to HTTP-only cookies managed by the backend.

[sonarqubecloud]

Quality Gate failed

Failed conditions
57.1% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud