From 31fb938f36edd58aaf23bdcf4400b1b8d01ee4ae Mon Sep 17 00:00:00 2001
From: Dylan De Faoite <dylanseandefaoite@gmail.com>
Date: Fri, 16 Oct 2026 17:41:29 +0100
Subject: [PATCH] fix logout error

---
 .../vodsystem/controllers/UserController.java   |  4 ++--
 .../com/ddf/vodsystem/services/UserService.java | 17 +++++++++++++++--
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/src/main/java/com/ddf/vodsystem/controllers/UserController.java b/src/main/java/com/ddf/vodsystem/controllers/UserController.java
index f0bae9a..350a7d0 100644
--- a/src/main/java/com/ddf/vodsystem/controllers/UserController.java
+++ b/src/main/java/com/ddf/vodsystem/controllers/UserController.java
@@ -113,7 +113,7 @@ public class UserController {
      */
     @PostMapping("/logout")
     public ResponseEntity<APIResponse<Void>> logout(
-            @CookieValue(name = "refreshToken") String refreshToken,
+            @CookieValue(name = "refreshToken", required = false) String refreshToken,
             HttpServletRequest request,
             HttpServletResponse response) {
         userService.logout(refreshToken);
@@ -155,7 +155,7 @@ public class UserController {
         ResponseCookie refreshTokenCookie = ResponseCookie.from("refreshToken", refreshToken)
                 .httpOnly(true)
                 .maxAge(refreshTokenMaxAge)
-                .sameSite("Strict")
+                .sameSite("Lax")
                 .secure(request.isSecure())
                 .path(REFRESH_COOKIE_PATH)
                 .build();
diff --git a/src/main/java/com/ddf/vodsystem/services/UserService.java b/src/main/java/com/ddf/vodsystem/services/UserService.java
index 968895f..f328a59 100644
--- a/src/main/java/com/ddf/vodsystem/services/UserService.java
+++ b/src/main/java/com/ddf/vodsystem/services/UserService.java
@@ -8,6 +8,8 @@ import com.ddf.vodsystem.repositories.UserRepository;
 import com.ddf.vodsystem.security.GoogleVerifierService;
 import com.ddf.vodsystem.security.JwtService;
 import com.ddf.vodsystem.security.TokenService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.transaction.annotation.Transactional;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
@@ -20,6 +22,8 @@ import java.util.Optional;
 
 @Service
 public class UserService {
+    private static final Logger logger = LoggerFactory.getLogger(UserService.class);
+
     private final GoogleVerifierService googleVerifierService;
     private final UserRepository userRepository;
     private final JwtService jwtService;
@@ -78,6 +82,8 @@ public class UserService {
         String refreshToken = tokenService.createSession(user);
         String jwt = jwtService.generateToken(user.getId());
 
+        logger.debug("Access and Refresh tokens issued for User ID {}", user.getId());
+
         return new TokenPackage(refreshToken, jwt);
     }
 
@@ -92,6 +98,8 @@ public class UserService {
         TokenService.Rotation rotation = tokenService.rotate(refreshToken);
         String jwt = jwtService.generateToken(rotation.userId());
 
+        logger.debug("New refresh and access token issued for user ID {}", rotation.userId());
+
         return new TokenPackage(rotation.newRefreshToken(), jwt);
     }
 
@@ -99,11 +107,16 @@ public class UserService {
      * Ends the session tied to a refresh token by revoking its token family.
      * Already-issued JWT access tokens stay valid until they expire.
      *
+     * Does nothing if the token is missing, malformed or unknown.
+     *
      * @param refreshToken the raw refresh token as a hex string, may be {@code null}
-     * @throws NotAuthenticated if the token is not valid hex
      */
     public void logout(String refreshToken) {
-        tokenService.revoke(refreshToken);
+        try {
+            tokenService.revoke(refreshToken);
+        } catch (NotAuthenticated e) {
+            logger.info("Malformed or missing token on logout()");
+        }
     }
 
     /**