fixes

backend/holy_backend/settings/base.py

@@ -132,7 +132,7 @@ AUTH_USER_MODEL = "api.User"
 
 REST_FRAMEWORK = {
     "DEFAULT_AUTHENTICATION_CLASSES": [
-        "rest_framework_simplejwt.authentication.JWTAuthentication",
+        "api.utils.cookie_auth.CookieJWTAuthentication",
     ],
     "DEFAULT_PERMISSION_CLASSES": [
         "rest_framework.permissions.IsAuthenticatedOrReadOnly",
@@ -151,10 +151,19 @@ SIMPLE_JWT = {
     "AUTH_HEADER_TYPES": ("Bearer",),
 }
 
+# httpOnly-cookie JWT config. The Authorization header path is kept as a
+# fallback during the rollout — once all clients use cookies it can be removed.
+JWT_AUTH_COOKIE_ACCESS = "access_token"
+JWT_AUTH_COOKIE_REFRESH = "refresh_token"
+JWT_AUTH_COOKIE_SECURE = False  # prod.py overrides to True
+JWT_AUTH_COOKIE_SAMESITE = "Lax"
+JWT_AUTH_COOKIE_PATH = "/"
+
 CORS_ALLOWED_ORIGINS = get_env_list(
     "CORS_ALLOWED_ORIGINS",
     [f"https://{DOMAIN}", "http://localhost:5173", "http://127.0.0.1:5173"],
 )
+CORS_ALLOW_CREDENTIALS = True
 
 FRONTEND_URL = os.environ.get("FRONTEND_URL", f"https://{DOMAIN}").rstrip("/")
 

backend/holy_backend/settings/prod.py

@@ -15,6 +15,7 @@ except KeyError as exc:
 SECURE_SSL_REDIRECT = True
 SESSION_COOKIE_SECURE = True
 CSRF_COOKIE_SECURE = True
+JWT_AUTH_COOKIE_SECURE = True
 SECURE_BROWSER_XSS_FILTER = True
 SECURE_CONTENT_TYPE_NOSNIFF = True
 SECURE_HSTS_SECONDS = 31536000  # 1 year

backend/holy_backend/urls.py

@@ -7,7 +7,9 @@ from django.urls import include, path
 from django.views.generic.base import TemplateView
 from django.views.static import serve
 from drf_spectacular.views import SpectacularAPIView, SpectacularRedocView, SpectacularSwaggerView
-from rest_framework_simplejwt.views import TokenObtainPairView, TokenRefreshView, TokenVerifyView
+from rest_framework_simplejwt.views import TokenVerifyView
+
+from api.views.auth import CookieLogoutView, CookieTokenObtainPairView, CookieTokenRefreshView
 
 
 def health_check(request):
@@ -25,12 +27,13 @@ urlpatterns = [
     # Ensure admin ends with a slash for Django's redirection logic
     path(f"{admin_url}/", admin.site.urls),
     path("api/", include("api.urls")),
-    path("api/auth/token/", TokenObtainPairView.as_view(), name="token_obtain_pair"),
-    path("api/auth/token/refresh/", TokenRefreshView.as_view(), name="token_refresh"),
+    path("api/auth/token/", CookieTokenObtainPairView.as_view(), name="token_obtain_pair"),
+    path("api/auth/token/refresh/", CookieTokenRefreshView.as_view(), name="token_refresh"),
     path("api/auth/token/verify/", TokenVerifyView.as_view(), name="token_verify"),
-    # Legacy alias: old DRF TokenAuth endpoint now returns a JWT pair so clients
-    # relying on POST /api/token/ keep working for one release.
-    path("api/token/", TokenObtainPairView.as_view(), name="api_token_legacy"),
+    path("api/auth/logout/", CookieLogoutView.as_view(), name="auth_logout"),
+    # Legacy alias: old DRF TokenAuth endpoint now sets cookies just like the
+    # canonical login route so clients relying on POST /api/token/ keep working.
+    path("api/token/", CookieTokenObtainPairView.as_view(), name="api_token_legacy"),
     path("api-auth/", include("rest_framework.urls")),
     path("api/schema/", SpectacularAPIView.as_view(), name="schema"),
     path(