From 782ab79c420b244127af9ad5f463ffc2db1382e3 Mon Sep 17 00:00:00 2001
From: Artemiy Solopov <a.solopov.001@gmail.com>
Date: Wed, 26 Aug 2026 15:18:04 +0300
Subject: [PATCH] CSRF and authentication mild rework

---
 .bsp/sbt.json                                            | 1 -
 app/controllers/authentication/AuthenticatedAction.scala | 7 +------
 conf/application.conf                                    | 4 ++++
 conf/routes                                              | 3 ---
 4 files changed, 5 insertions(+), 10 deletions(-)
 delete mode 100644 .bsp/sbt.json

diff --git a/.bsp/sbt.json b/.bsp/sbt.json
deleted file mode 100644
index 335180c..0000000
--- a/.bsp/sbt.json
+++ /dev/null
@@ -1 +0,0 @@
-{"name":"sbt","version":"1.12.13","bspVersion":"2.1.0-M1","languages":["scala"],"argv":["/usr/lib/jvm/java-21-openjdk-amd64/bin/java","-Xms100m","-Xmx100m","-classpath","/home/artemiy/.local/share/JetBrains/IntelliJIdea2026.1/Scala/launcher/sbt-launch.jar","-Dsbt.script=/home/artemiy/.local/bin/sbt","xsbt.boot.Boot","-bsp"]}
\ No newline at end of file
diff --git a/app/controllers/authentication/AuthenticatedAction.scala b/app/controllers/authentication/AuthenticatedAction.scala
index c765769..0a1a155 100644
--- a/app/controllers/authentication/AuthenticatedAction.scala
+++ b/app/controllers/authentication/AuthenticatedAction.scala
@@ -12,14 +12,9 @@ import scala.concurrent.{ExecutionContext, Future}
 class AuthenticatedRequest[A](val token: AuthToken, val user: User, request: Request[A]) extends WrappedRequest[A](request)
 
 class AuthenticatedAction @Inject()(authTokensDao: AuthTokensDAO)(implicit val executionContext: ExecutionContext) extends ActionRefiner[Request, AuthenticatedRequest] {
-  private final val tokenPrefix = "Token"
-
   override protected def refine[A](request: Request[A]): Future[Either[Result, AuthenticatedRequest[A]]] = {
     val authHeader = request.headers.get("Authorization")
-      .flatMap { header =>
-        if header.startsWith(tokenPrefix) then Some(header.substring(tokenPrefix.length).trim)
-        else None
-      }
+      .map(_.split(" ", 2)(1))
       .filter(_.nonEmpty)
 
     authHeader match {
diff --git a/conf/application.conf b/conf/application.conf
index 32acc96..270db53 100644
--- a/conf/application.conf
+++ b/conf/application.conf
@@ -2,6 +2,10 @@
 
 play.http.filters=controllers.filters.Filters
 
+play.filters.csrf.header.bypassHeaders {
+    X-Requested-With = "*"
+}
+
 play.modules.enabled += "mqttClient.Module"
 
 slick.dbs.default = {
diff --git a/conf/routes b/conf/routes
index da008e8..68008dc 100644
--- a/conf/routes
+++ b/conf/routes
@@ -7,12 +7,9 @@
 GET     /                           controllers.HomeController.index()
 
 POST    /login                      controllers.authentication.SessionsController.login()
-# TODO: enable it later
-+nocsrf
 DELETE  /logout                     controllers.authentication.SessionsController.logout()
 
 # Map static resources from the /public folder to the /assets URL path
 GET     /assets/*file               controllers.Assets.versioned(path="/public", file: Asset)
 
-+nocsrf
 POST    /auctions                   controllers.AuctionsController.create()
\ No newline at end of file