security: fix CSRF token validation alerts

src/OpenCashFlow.API/AppStart/05_Auth.cs

@@ -45,14 +45,6 @@ public static WebApplicationBuilder AppStartConfigureAuth(this WebApplicationBui
 
             options.Events = new JwtBearerEvents
             {
-                OnMessageReceived = context =>
-                {
-                    if (string.IsNullOrEmpty(context.Token))
-                    {
-                        context.Token = context.Request.Cookies[OpenCashFlow.Contracts.Core.Configuration.AuthCookieName];
-                    }
-                    return Task.CompletedTask;
-                },
                 OnAuthenticationFailed = context =>
                 {
                     context.Response.StatusCode = 401;

src/OpenCashFlow.API/Controllers/AuditLogController.cs

@@ -11,6 +11,7 @@
 namespace OpenCashFlow.API.Controllers
 {
     [ApiController]
+    [IgnoreAntiforgeryToken]
     [Authorize(Roles = "CompanyAdmin,InstanceAdmin")]
     [Route("v{version:apiVersion}/Admin/AuditLog")]
     [ApiVersion("1.0")]

src/OpenCashFlow.API/Controllers/AuthenticationController.cs

@@ -10,6 +10,7 @@
 namespace OpenCashFlow.API.Controllers
 {
     [ApiController]
+    [IgnoreAntiforgeryToken]
     [Route("v{version:apiVersion}/[controller]")]
     [ApiVersion("1.0")]
     [ApiVersion("2.0")]

src/OpenCashFlow.API/Controllers/CompanyController.cs

@@ -9,6 +9,7 @@
 namespace OpenCashFlow.API.Controllers
 {
     [ApiController, Authorize(Policy = "CompanyMember")]
+    [IgnoreAntiforgeryToken]
     [Route("v{version:apiVersion}/")]
     [ApiVersion("1.0")]
     public partial class CompanyController(ICompanyService CompanyService, ILogger<CompanyController> logger) : Controller

src/OpenCashFlow.API/Controllers/DevEmailController.cs

@@ -6,6 +6,7 @@ namespace OpenCashFlow.API.Controllers
 {
 #if DEBUG
     [ApiController]
+    [IgnoreAntiforgeryToken]
     [Route("dev/email")]
     [AllowAnonymous]
     [ApiExplorerSettings(IgnoreApi = true)]

src/OpenCashFlow.API/Controllers/EmployeeController.cs

@@ -8,6 +8,7 @@
 namespace OpenCashFlow.API.Controllers
 {
     [ApiController, Authorize]
+    [IgnoreAntiforgeryToken]
     [Route("v{version:apiVersion}/")]
     [ApiVersion("1.0")]
     public partial class EmployeeController(IEmployeeService EmployeeService, ILogger<EmployeeController> logger) : Controller

src/OpenCashFlow.API/Controllers/PaymentController.Cash.cs

@@ -11,6 +11,7 @@
 namespace OpenCashFlow.API.Controllers
 {
     [ApiController]
+    [IgnoreAntiforgeryToken]
     [Authorize(Roles = "CompanyAdmin,InstanceAdmin")]
     [Route("v{version:apiVersion}/admin/cash")]
     [ApiVersion("1.0")]

src/OpenCashFlow.API/Controllers/PaymentController.cs

@@ -12,6 +12,7 @@
 namespace OpenCashFlow.API.Controllers
 {
     [ApiController, Authorize(Policy = "CompanyMember")]
+    [IgnoreAntiforgeryToken]
     [Route("v{version:apiVersion}/")]
     [ApiVersion("1.0")]
     public partial class PaymentController(IPaymentService PaymentService, IAuditLogService auditLogService, ILogger<PaymentController> logger) : Controller

src/OpenCashFlow.API/Controllers/RolesController.cs

@@ -7,6 +7,7 @@
 namespace OpenCashFlow.API.Controllers
 {
     [ApiController, Authorize]
+    [IgnoreAntiforgeryToken]
     [Route("v{version:apiVersion}/")]
     [ApiVersion("1.0")]
     public class RolesController(IRoleService roleService) : Controller
@@ -21,4 +22,3 @@ public async Task<ActionResult<IEnumerable<Role_List_DTO>>> GetVisibleRoles(Canc
         }
     }
 }
-

src/OpenCashFlow.API/Controllers/SetupController.cs

@@ -9,6 +9,7 @@
 namespace OpenCashFlow.API.Controllers
 {
     [ApiController]
+    [IgnoreAntiforgeryToken]
     [AllowAnonymous]
     [Route("v{version:apiVersion}/[controller]")]
     [ApiVersion("1.0")]

src/OpenCashFlow.API/Controllers/UsersController.cs

@@ -11,6 +11,7 @@
 namespace OpenCashFlow.API.Controllers
 {
     [ApiController]
+    [IgnoreAntiforgeryToken]
     [Authorize(Roles = "CompanyAdmin")]
     [Route("v{version:apiVersion}/Admin/Users")]
     [ApiVersion("1.0")]

src/OpenCashFlow.WebApp/Controllers/AccountController.cs

@@ -194,6 +194,50 @@ public async Task<IActionResult> ChangePassword(PasswordVM vm)
             return await LoadEditAccountView(userId.Value);
         }
 
+        [HttpPost]
+        [ValidateAntiForgeryToken]
+        [Route("Account/RefreshSession")]
+        public async Task<IActionResult> RefreshSession(CancellationToken cancellationToken)
+        {
+            var tokenResult = await _authAPIService.RegenerateTokenAsync(cancellationToken);
+            if (!tokenResult.Success || tokenResult.Data == null || string.IsNullOrWhiteSpace(tokenResult.Data.Token))
+            {
+                _logger.LogWarning("Session refresh failed: {Message}", tokenResult.Message);
+                return Unauthorized(new { success = false });
+            }
+
+            var newToken = tokenResult.Data.Token;
+            var expirationTime = TryGetJwtExpiration(newToken)
+                ?? DateTimeOffset.UtcNow.AddMinutes(OpenCashFlow.Contracts.Core.Configuration.WebSessionDurationMinutes);
+
+            var authCookieOptions = new CookieOptions
+            {
+                Domain = _configuration["Account:CookieDomain"],
+                HttpOnly = true,
+                Secure = true,
+                SameSite = SameSiteMode.Lax,
+                Expires = expirationTime
+            };
+
+            HttpContext.Response.Cookies.Append(OpenCashFlow.Contracts.Core.Configuration.AuthCookieName, newToken, authCookieOptions);
+
+            var infoCookieOptions = new CookieOptions
+            {
+                Domain = _configuration["Account:CookieDomain"],
+                HttpOnly = false,
+                Secure = true,
+                SameSite = SameSiteMode.Lax,
+                Expires = expirationTime
+            };
+
+            HttpContext.Response.Cookies.Append(
+                OpenCashFlow.Contracts.Core.Configuration.AuthCookieName + ".Info",
+                expirationTime.ToUnixTimeSeconds().ToString(),
+                infoCookieOptions);
+
+            return Ok(new { success = true });
+        }
+
         private async Task<IActionResult> LoadEditAccountView(Guid userId)
         {
             var detail = await _employeeAPIService.GetEmployeeByIDAsync(userId);

src/OpenCashFlow.WebApp/Controllers/CompanyController.Cash.cs

@@ -94,6 +94,7 @@ public async Task<IActionResult> GetCashLedger(int skip = 0, int take = 50, Canc
         public class AdjustRequest { public decimal? Delta { get; set; } public string Reason { get; set; } = string.Empty; }
 
         [HttpPost("CashLedger/Adjust")]
+        [ValidateAntiForgeryToken]
         public async Task<IActionResult> Adjust([FromBody] AdjustRequest request, CancellationToken ct)
         {
             var giClaim = User?.FindFirst("TenantID")?.Value;

src/OpenCashFlow.WebApp/Controllers/Internal/PaymentController.cs

@@ -34,6 +34,7 @@ public IActionResult GetPaymentsList()
         }
 
         [HttpPost]
+        [ValidateAntiForgeryToken]
         public async Task<IActionResult> FilterPayments(Payment_Filter_DTO filters)
         {
             try
@@ -65,6 +66,7 @@ public IActionResult EditPaymentModal(Guid paymentID)
         }
 
         [HttpPost]
+        [ValidateAntiForgeryToken]
         public async Task<IActionResult> CreatePayment(Payment_Create_DTO dto)
         {
             if (!ModelState.IsValid)
@@ -99,6 +101,7 @@ public async Task<IActionResult> CreatePayment(Payment_Create_DTO dto)
         }
 
         [HttpPost]
+        [ValidateAntiForgeryToken]
         public async Task<IActionResult> UpdatePayment(Payment_Update_DTO editDto)
         {
             if (!ModelState.IsValid)
@@ -118,6 +121,7 @@ public async Task<IActionResult> UpdatePayment(Payment_Update_DTO editDto)
         }
 
         [HttpPost]
+        [ValidateAntiForgeryToken]
         public async Task<IActionResult> DeletePayment(Guid paymentID)
         {
             if (paymentID == Guid.Empty)
@@ -162,6 +166,7 @@ public async Task<IActionResult> GetCashBalance(CancellationToken cancellationTo
         }
 
         [HttpPost]
+        [ValidateAntiForgeryToken]
         public async Task<IActionResult> GetCalendarEvents([FromBody] Payment_Filter_DTO filters)
         {
             try

src/OpenCashFlow.WebApp/Views/Company/Company_CashLedger.cshtml

@@ -252,6 +252,9 @@
       $.ajax({
         url: '/Company/CashLedger/Adjust',
         method: 'POST',
+        headers: window.openCashFlowAntiForgeryHeaders
+          ? window.openCashFlowAntiForgeryHeaders()
+          : {},
         contentType: 'application/json',
         data: JSON.stringify({ delta: delta, reason: reason }),
         success: function (resp) {

src/OpenCashFlow.WebApp/Views/Payments/Index.cshtml

@@ -22,6 +22,12 @@
     </script>
     @* <script src="~/lib/microsoft/signalr/dist/browser/signalr.min.js"></script> *@
     <script>
+        function antiForgeryHeaders() {
+          return window.openCashFlowAntiForgeryHeaders
+            ? window.openCashFlowAntiForgeryHeaders()
+            : {};
+        }
+
         window.parseAsUtc = function parseAsUtc(input) {
           if (!input) return new Date();
 
@@ -578,6 +584,7 @@
           $.ajax({
             url: '/internal/Payment/DeletePayment',
             method: 'POST',
+            headers: antiForgeryHeaders(),
             data: { paymentID: paymentID },
             success: function(resp) {
               // Re-enable the button and restore the text
@@ -718,6 +725,7 @@
             $.ajax({
                 url: '/internal/Payment/FilterPayments',
                 method: 'POST',
+                headers: antiForgeryHeaders(),
                 data: formData,
                 success: function(resp) {
                     if (resp.success) {
@@ -862,6 +870,7 @@
             $.ajax({
                 url: '/internal/Payment/FilterPayments',
                 method: 'POST',
+                headers: antiForgeryHeaders(),
                 data: {
                     FromDate: dateIso + 'T00:00:00',
                     ToDate:   dateIso + 'T23:59:59',

src/OpenCashFlow.WebApp/Views/Payments/Partials/_PaymentsList.cshtml

@@ -52,6 +52,9 @@
             $.ajax({
                 url: '/internal/Payment/DeletePayment',
                 method: 'POST',
+                headers: window.openCashFlowAntiForgeryHeaders
+                    ? window.openCashFlowAntiForgeryHeaders()
+                    : {},
                 data: { paymentID: paymentID },
                 success: function (resp) {
                     if (resp.success) {

src/OpenCashFlow.WebApp/Views/Shared/Sections/_Scripts.cshtml

@@ -6,6 +6,7 @@
 <environment exclude="Development">
     <script src="~/js/tabler.min.js" asp-append-version="true"></script>
 </environment>
+<script src="~/js/components/antiforgery.js" asp-append-version="true"></script>
 
 @if (User?.Identity?.IsAuthenticated ?? false)
 {
@@ -14,5 +15,5 @@
             data-disconnect-url="@Url.Content("~/Account/Disconnect")"
             data-auth-info-cookie-name="@(Configuration.AuthCookieName).Info"
             data-inactivity-minutes="@(Configuration.WebSessionDurationMinutes)"
-            data-refresh-url="@($"{_configuration["Account:API"]}/v1/Authentication/refresh")"></script>
+            data-refresh-url="@Url.Content("~/Account/RefreshSession")"></script>
 }

src/OpenCashFlow.WebApp/Views/Shared/Sections/_ScriptsFront.cshtml

@@ -6,6 +6,7 @@
 <environment exclude="Development">
     <script src="~/js/tabler.min.js" asp-append-version="true"></script>
 </environment>
+<script src="~/js/components/antiforgery.js" asp-append-version="true"></script>
 
 @if (User?.Identity?.IsAuthenticated ?? false)
 {
@@ -14,5 +15,5 @@
             data-disconnect-url="@Url.Content("~/Account/Disconnect")"
             data-auth-info-cookie-name="@(Configuration.AuthCookieName).Info"
             data-inactivity-minutes="@(Configuration.WebSessionDurationMinutes)"
-            data-refresh-url="@($"{_configuration["Account:API"]}/v1/Authentication/refresh")"></script>
+            data-refresh-url="@Url.Content("~/Account/RefreshSession")"></script>
 }

src/OpenCashFlow.WebApp/Views/Shared/_CommonMasterLayout.cshtml

@@ -1,11 +1,13 @@
 @inject IHttpContextAccessor httpContextAccessor
 @inject IWebHostEnvironment Env
+@inject Microsoft.AspNetCore.Antiforgery.IAntiforgery Antiforgery
 
 @{
     bool isFront = ViewData["isFront"] is bool isFrontValue && isFrontValue;
     ViewData["main"] = isFront ? "front-" : "";
     ViewData["frontVar"] = isFront ? "Front" : "";
     string bodyClass = isFront ? "body-marketing body-gradient" : "";
+    string? requestVerificationToken = Antiforgery.GetAndStoreTokens(Context).RequestToken;
 }
 
 <!DOCTYPE html>
@@ -25,6 +27,7 @@
         <meta name="robots" content="noindex,nofollow,noarchive" />
     }
     <meta name="description" content="" />
+    <meta name="request-verification-token" content="@requestVerificationToken" />
 
     <!-- Favicons -->
     <link rel="icon" type="image/png" href="~/favicon.png" />

src/OpenCashFlow.WebApp/wwwroot/js/components/antiforgery.js

@@ -0,0 +1,19 @@
+(function () {
+    "use strict";
+
+    function getToken() {
+        const meta = document.querySelector('meta[name="request-verification-token"]');
+        if (meta && meta.content) {
+            return meta.content;
+        }
+
+        const input = document.querySelector('input[name="__RequestVerificationToken"]');
+        return input ? input.value : "";
+    }
+
+    window.openCashFlowAntiForgeryToken = getToken;
+    window.openCashFlowAntiForgeryHeaders = function () {
+        const token = getToken();
+        return token ? { "RequestVerificationToken": token } : {};
+    };
+})();

src/OpenCashFlow.WebApp/wwwroot/js/components/session-watchdog.js

@@ -104,7 +104,10 @@
             try {
                 const response = await fetch(refreshUrl, {
                     method: "POST",
-                    credentials: "include"
+                    credentials: "same-origin",
+                    headers: window.openCashFlowAntiForgeryHeaders
+                        ? window.openCashFlowAntiForgeryHeaders()
+                        : {}
                 });
 
                 if (!response.ok) {

tests/OpenCashFlow.Test/Tests/API/Payments_Tests.cs

@@ -4,6 +4,7 @@
 using Microsoft.Extensions.DependencyInjection;
 using OpenCashFlow.Infrastructure.Persistence;
 using OpenCashFlow.Contracts.DTOs;
+using OpenCashFlow.Contracts.Core;
 using OpenCashFlow.Infrastructure.Persistence.Entities;
 using System.Net;
 using System.Net.Http.Headers;
@@ -116,6 +117,34 @@ public async Task CreatePayment_WithoutAuthentication_ShouldFail()
 
         }
 
+        [Trait("Layer", "API")]
+        [Trait("Feature", "Payments")]
+        [Trait("Type", "Security")]
+        [Trait("Priority", "High")]
+        [Fact(DisplayName = "POST /v1/payments should reject JWT supplied only by cookie")]
+        public async Task CreatePayment_WithJwtOnlyInCookie_ShouldFail()
+        {
+            var userId = Guid.Parse("00000000-0000-0000-0000-000000000001");
+            var token = await _factory.GenerateJwtTokenAsync(userId);
+            var client = _factory.CreateClient();
+            client.DefaultRequestHeaders.Add("Cookie", $"{Configuration.AuthCookieName}={token}");
+
+            var payment = new Payment_Create_DTO
+            {
+                TenantID = Guid.Parse("00000000-0000-0000-0000-000000000001"),
+                UserID = userId,
+                Amount = 150,
+                EntryType = nameof(EntryTypeEnum.Income),
+                PaymentMethodID = Guid.Parse("00000000-0000-0000-0000-000000000001"),
+                DocumentTypeID = Guid.Parse("00000000-0000-0000-0000-000000000001"),
+                Description = "Cookie-only JWT should not authenticate API requests"
+            };
+
+            var response = await client.PostAsJsonAsync("/v1/Payment", payment);
+
+            Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+        }
+
         // Payment creation [FAIL] (using an unauthorized employee)
         [Trait("Layer", "API")]
         [Trait("Feature", "Payments")]