CSRF and authentication mild rework

.bsp/sbt.json

@@ -1 +0,0 @@
-{"name":"sbt","version":"1.12.13","bspVersion":"2.1.0-M1","languages":["scala"],"argv":["/usr/lib/jvm/java-21-openjdk-amd64/bin/java","-Xms100m","-Xmx100m","-classpath","/home/artemiy/.local/share/JetBrains/IntelliJIdea2026.1/Scala/launcher/sbt-launch.jar","-Dsbt.script=/home/artemiy/.local/bin/sbt","xsbt.boot.Boot","-bsp"]}

app/controllers/authentication/AuthenticatedAction.scala

@@ -12,14 +12,9 @@ import scala.concurrent.{ExecutionContext, Future}
 class AuthenticatedRequest[A](val token: AuthToken, val user: User, request: Request[A]) extends WrappedRequest[A](request)
 
 class AuthenticatedAction @Inject()(authTokensDao: AuthTokensDAO)(implicit val executionContext: ExecutionContext) extends ActionRefiner[Request, AuthenticatedRequest] {
-  private final val tokenPrefix = "Token"
-
   override protected def refine[A](request: Request[A]): Future[Either[Result, AuthenticatedRequest[A]]] = {
     val authHeader = request.headers.get("Authorization")
-      .flatMap { header =>
-        if header.startsWith(tokenPrefix) then Some(header.substring(tokenPrefix.length).trim)
-        else None
-      }
+      .map(_.split(" ", 2)(1))
       .filter(_.nonEmpty)
 
     authHeader match {

conf/application.conf

@@ -2,6 +2,10 @@
 
 play.http.filters=controllers.filters.Filters
 
+play.filters.csrf.header.bypassHeaders {
+    X-Requested-With = "*"
+}
+
 play.modules.enabled += "mqttClient.Module"
 
 slick.dbs.default = {

conf/routes

@@ -7,12 +7,9 @@
 GET     /                           controllers.HomeController.index()
 
 POST    /login                      controllers.authentication.SessionsController.login()
-# TODO: enable it later
-+nocsrf
 DELETE  /logout                     controllers.authentication.SessionsController.logout()
 
 # Map static resources from the /public folder to the /assets URL path
 GET     /assets/*file               controllers.Assets.versioned(path="/public", file: Asset)
 
-+nocsrf
 POST    /auctions                   controllers.AuctionsController.create()