ECSoC_2026 & ELUSoC_2026 Fix: Sensitive Tokens Leaked in Login JSON Response

[Sairaj2033]

Bug Description

The login handler returns both the token (JWT) and refreshToken as top-level fields in the JSON response body[cite: 1].

Because both of these tokens are already set as httpOnly cookies, returning them in the JSON body completely defeats the httpOnly protection[cite: 1]. This makes the session vulnerable to cross-site scripting (XSS) attacks, as JavaScript on the page can easily read the raw tokens[cite: 1].

Location & Severity

• File: controllers/Authcontroller.js (Lines 226–228)[cite: 1]
• Severity: High[cite: 1]

[Sairaj2033]

@Sitaram8472 i would like to Fix this issue, I request You to Assign this Issue to me,
Contributor from ECSOC and ELUSOC both

[MILAN-123865]

Hi! I'd like to work on this issue as part of ECSoC26. The proposed solution looks clear, and I'm confident I can implement it while following the project's coding standards. Could you please assign this issue to me? Thank you!