Add XSRF-TOKEN cookie on user update and revokes it on user logout

src/authentication/authentication.controller.ts

@@ -71,6 +71,14 @@ export class AuthenticationController {
         httpOnly: true,
         secure: true,
       },
+    ).cookie(
+      'XSRF-TOKEN',
+      '',
+      {
+        domain: this._configService.config.xsrfTokenCookieDomain,
+        expires: new Date(0),
+        sameSite: 'Strict',
+      },
     ).status(HttpStatus.OK).send(true);
   }
 
@@ -154,7 +162,15 @@ export class AuthenticationController {
           httpOnly: true,
           secure: true,
         },
-      ).status(HttpStatus.OK).send({ userInfo: updateResult.userInfo, xsrfToken: updateResult.xsrfToken });
+      ).cookie(
+        'XSRF-TOKEN',
+        updateResult.xsrfToken,
+        {
+          domain: this._configService.config.xsrfTokenCookieDomain,
+          expires: cookieExpiresAt,
+          sameSite: 'Strict',
+        },
+      ).status(HttpStatus.OK).send({ userInfo: updateResult.userInfo });
     } catch (error) {
       if (error instanceof HttpException) {
         throw error;

src/authentication/authentication.model.ts

@@ -170,7 +170,7 @@ export class JWTTokenInfo {
   identity_provider: string;
 }
 
-export class UserInfoUpdateResponse {
+export class UserInfoUpdateServiceResponse {
   @ApiModelProperty()
   @IsString()
   jwtToken: string;
@@ -182,6 +182,11 @@ export class UserInfoUpdateResponse {
   xsrfToken: string;
 }
 
+export class UserInfoUpdateResponse {
+  @ApiModelProperty()
+  userInfo: PublicUserInfo;
+}
+
 export class UserInfoWithoutPassword {
   @ApiModelProperty()
   @IsString()

src/authentication/authentication.service.ts

@@ -8,7 +8,7 @@ bluebird.promisifyAll(redis);
 import * as jwt from 'jsonwebtoken';
 import {
   UserInfo, JwtInfo, LoginForm, KongUserJwtCredential, JWTTokenInfo, UserUpdateForm, UserInfoWithoutPassword,
-  PublicUserInfo, UserInfoUpdateResponse, LoginServiceResponse,
+  PublicUserInfo, UserInfoUpdateResponse, LoginServiceResponse, UserInfoUpdateServiceResponse,
 } from './authentication.model';
 import { handleError } from '../helpers';
 
@@ -116,7 +116,7 @@ export class AuthenticationService {
     }
   }
 
-  async updateUserInfo(token: string, form: UserUpdateForm, xsrfToken: string): Promise<UserInfoUpdateResponse> {
+  async updateUserInfo(token: string, form: UserUpdateForm, xsrfToken: string): Promise<UserInfoUpdateServiceResponse> {
     this.logger.log('Entering function', `${AuthenticationService.name} - ${this.updateUserInfo.name}`);
 
     try {