feat: enhance security by implementing HttpOnly refresh tokens and in-memory access token management

- Added isomorphic-dompurify for improved XSS protection
- Refactored token storage to use in-memory management for access tokens
- Implemented server-side route handlers for OAuth token management
- Introduced security headers in next.config.js
- Removed client-side exposure of client_secret and sensitive tokens
- Updated API interceptors to handle token refresh logic
- Cleaned up cookie management for refresh tokens

components/register/verificationPage/SendReq.js

@@ -3,6 +3,7 @@ import { request } from "@/services/response";
 import Cookies from "js-cookie";
 import { toast } from "react-toastify";
 import { handleTimeExpiresToken } from "@/helper";
+import { setAccessToken } from "@/lib/tokenStore";
 
 function SendReq({
   loading,
@@ -44,14 +45,13 @@ function SendReq({
     const isHttps = window.location.protocol === "https:";
     const isLocalhost = hostname.includes("localhost");
 
-    // تنظیمات پایه
+    // فقط داده‌های غیرحساس در کوکی JS؛ access_token در memory، refresh_token در کوکی HttpOnly سرور
     let cookieOptions = {
       path: "/",
       sameSite: "lax",
-      expires: expiresTime.accessTokenExpires,
+      expires: expiresTime.refreshTokenExpires,
     };
 
-    // اگر روی دامنه اصلی و https بود
     if (!isLocalhost && isHttps) {
       cookieOptions = {
         ...cookieOptions,
@@ -60,17 +60,8 @@ function SendReq({
       };
     }
 
-    Cookies.set("access_token", response.access_token, cookieOptions);
-
-    Cookies.set("refresh_token", response.refresh_token, {
-      ...cookieOptions,
-      expires: expiresTime.refreshTokenExpires,
-    });
-
-    Cookies.set("uuid", uuid, {
-      ...cookieOptions,
-      expires: expiresTime.refreshTokenExpires,
-    });
+    setAccessToken(response.access_token);
+    Cookies.set("uuid", uuid, cookieOptions);
 
     getInfo(response.access_token, cookieOptions);
   };