Updated after CodeRabbit comments

Author: Stelle83

src/main/java/demo/codeexample/auth/application/AuthService.java

@@ -49,6 +49,9 @@ public LoginResponse login(LoginRequest request) {
     public void changePassword(ChangePasswordRequest request, String authHeader) {
 
         // Extract email from token
+        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
+            throw new UnauthorizedException("Invalid authorization header");
+        }
         String token = authHeader.substring(7);
         String email = jwtService.extractEmail(token);
 

src/main/java/demo/codeexample/security/JwtAuthenticationFilter.java

@@ -3,6 +3,7 @@
 import demo.codeexample.user.domain.UserRepository;
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.ServletException;
+import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -32,40 +33,64 @@ protected void doFilterInternal(HttpServletRequest request,
                                     FilterChain filterChain)
             throws ServletException, IOException {
 
+        // 1. Try Authorization header first (API calls from Insomnia/frontend)
+        String token = extractFromHeader(request);
 
-        // 1. Look for the Authorization header
-        String authHeader = request.getHeader("Authorization");
+        // 2. If no header, try cookie (web browser after OAuth2/form login)
+        if (token == null) {
+            token = extractFromCookie(request);
+        }
 
-        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
+        // 3. If no token found anywhere — pass through unauthenticated
+        if (token == null) {
             filterChain.doFilter(request, response);
             return;
         }
 
-        // 2. Extract the token (remove "Bearer " prefix)
-        String token = authHeader.substring(7);
-
-        // 3. Validate the token
+        // 4. Validate token
         if (!jwtService.isTokenValid(token)) {
             filterChain.doFilter(request, response);
             return;
         }
 
-        // 4. Extract email and load user
-        String role = jwtService.extractRole(token);
-        Long userId = jwtService.extractUserId(token);
+        // 5. Extract claims
+        String role   = jwtService.extractRole(token);
+        Long   userId = jwtService.extractUserId(token);
 
-        // 5. Tell Spring Security "this user is authenticated"
+        // 6. Set authentication in Spring Security context
         UsernamePasswordAuthenticationToken authentication =
                 new UsernamePasswordAuthenticationToken(
                         userId,
                         null,
                         List.of(new SimpleGrantedAuthority("ROLE_" + role))
                 );
 
-        SecurityContextHolder.getContext().setAuthentication(authentication); // SecurityContext = Spring's memory of "who is currently logged in"
-
-        // 6. Continue to the actual endpoint
+        SecurityContextHolder.getContext().setAuthentication(authentication);
         filterChain.doFilter(request, response);
+    }
+
+    // ─────────────────────────────────────────
+    // PRIVATE HELPERS
+    // ─────────────────────────────────────────
+
+    private String extractFromHeader(HttpServletRequest request) {
+        String authHeader = request.getHeader("Authorization");
+        if (authHeader != null && authHeader.startsWith("Bearer ")) {
+            return authHeader.substring(7);
+        }
+        return null;
+    }
+
+    private String extractFromCookie(HttpServletRequest request) {
+        if (request.getCookies() == null) return null;
 
+        for (Cookie cookie : request.getCookies()) {
+            if ("jwt".equals(cookie.getName())) {
+                return cookie.getValue();
+            }
+        }
+        return null;
     }
+
+
 }

src/main/java/demo/codeexample/security/JwtService.java

@@ -2,11 +2,12 @@
 
 import demo.codeexample.user.Role;
 import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.JwtException;
 import io.jsonwebtoken.Jwts;
 import io.jsonwebtoken.io.Decoders;
 import io.jsonwebtoken.security.Keys;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.security.oauth2.jwt.JwtException;
+
 import org.springframework.stereotype.Service;
 
 import javax.crypto.SecretKey;
@@ -54,7 +55,7 @@ public boolean isTokenValid(String token) {
         try {
             parseClaims(token);
             return true;
-        } catch (JwtException e) {
+        } catch (JwtException | IllegalArgumentException e) {
             return false;
         }
     }

src/main/java/demo/codeexample/security/OAuth2LoginSuccessHandler.java

@@ -56,6 +56,8 @@ public void onAuthenticationSuccess(HttpServletRequest request,
         // 5. Store in cookie + redirect based on role
         Cookie cookie = new Cookie("jwt", token);
         cookie.setHttpOnly(true);
+        cookie.setSecure(true);     //Only send this over HTTPS
+        cookie.setAttribute("Samesite", "Strict");      //CSRF protection
         cookie.setPath("/");
         cookie.setMaxAge(86400);
         response.addCookie(cookie);

src/main/java/demo/codeexample/user/application/UserService.java

@@ -136,6 +136,13 @@ public void deactivateUser(Long id) {
     @Override
     public UserDto createOAuthUser(String email, String firstName, String lastName) {
 
+        //Guard againt race conditions in concurrent OAuth2 logins
+        if (repository.existsByEmail(email)) {
+            return repository.findByEmail(email)
+                    .map(entity -> mapper.map(entity, UserDto.class))
+                    .orElseThrow();
+        }
+
         User newUser = new User();
         newUser.setEmail(email);
         newUser.setFirstName(firstName != null ? firstName : "Unknown");