login adds cookie on the server side

frontend-js/src/main/js/ServerConnector.js

@@ -860,16 +860,9 @@ ServerConnector.login = function(login, password) {
   } else {
     params.login = "anonymous";
   }
-  return self.sendPostRequest(self.loginUrl(), params).then(function(content) {
-    var obj = JSON.parse(content);
-    var token = obj.id;
-    if (token === undefined) {
-      return Promise.reject(obj.error);
-    } else {
-      self.getSessionData().setToken(token);
-      self.getSessionData().setLogin(params.login);
-      return Promise.resolve(token);
-    }
+  return self.sendPostRequest(self.loginUrl(), params).then(function() {
+    self.getSessionData().setLogin(params.login);
+    return Promise.resolve(self.getSessionData().getToken());
   });
 };
 

frontend-js/src/test/js/ServerConnector-test.js

@@ -117,13 +117,6 @@ describe('ServerConnector', function() {
     });
   });
 
-  it('getToken without login', function() {
-    ServerConnector.getSessionData().setToken(undefined);
-    return ServerConnector.getToken().then(function(token) {
-      assert.ok(token);
-    });
-  });
-
   it('logout', function() {
     return ServerConnector.logout().then(function() {
       assert.equal(ServerConnector.getSessionData().getToken(), undefined);

rest-api/pom.xml

@@ -61,6 +61,13 @@
     	<version>${jackson.version}</version>
 		</dependency>		
 
+		<dependency>
+			<groupId>javax.servlet</groupId>
+			<artifactId>servlet-api</artifactId>
+			<version>${servlet-api.version}</version>
+			<scope>provided</scope>
+		</dependency>
+
 		<dependency>
 			<groupId>org.mockito</groupId>
 			<artifactId>mockito-all</artifactId>

rest-api/src/main/java/lcsb/mapviewer/api/users/UserController.java

 package lcsb.mapviewer.api.users;
 
+import java.io.IOException;
+import java.util.Calendar;
 import java.util.HashMap;
 import java.util.Map;
 
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletResponse;
+
 import org.apache.log4j.Logger;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
@@ -32,16 +37,32 @@ public class UserController extends BaseController {
 	@RequestMapping(value = "/doLogin", method = { RequestMethod.GET, RequestMethod.POST }, produces = { MediaType.APPLICATION_JSON_VALUE })
 	public Map<String, Object> login(//
 			@RequestParam(value = "login", defaultValue = Configuration.ANONYMOUS_LOGIN) String login, //
-			@RequestParam(value = "password", required = false) String password//
-	) throws SecurityException {
+			@RequestParam(value = "password", required = false) String password, //
+			HttpServletResponse response //
+	) throws SecurityException, IOException {
 		AuthenticationToken token = userService.login(login, password);
-		Map<String, Object> result = new HashMap<>();
 		if (token == null) {
 			throw new SecurityException("Invalid credentials");
 		} else {
-			result.put("id", token.getId());
+			Map<String, Object> result = new HashMap<>();
+			final Boolean useSecureCookie = false;
+			final int expiryTime = (int) (token.getExpires().getTimeInMillis() - Calendar.getInstance().getTimeInMillis()) / 1000; // 24h
+																																																														 // in
+																																																														 // seconds
+			final String cookiePath = "/";
+
+			Cookie cookie = new Cookie("MINERVA_AUTH_TOKEN", token.getId());
+
+			cookie.setSecure(useSecureCookie);
+			cookie.setMaxAge(expiryTime);
+			cookie.setPath(cookiePath);
+
+			response.addCookie(cookie);
+			response.getWriter().write("{\"info\":\"Login successful. TOKEN returned as a cookie\"}");
+			response.getWriter().flush();
+			response.getWriter().close();
+			return result;
 		}
-		return result;
 	}
 
 	@RequestMapping(value = "/users/{login}", method = { RequestMethod.GET, RequestMethod.POST }, produces = { MediaType.APPLICATION_JSON_VALUE })