Updated the Login code so it responds with a set-cookie header for the session token. Still looking into if this is the right thing to do however.

SecureCore/Controllers/AuthController.cs

@@ -1,5 +1,7 @@
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Http;
 using System;
+using System.Web;
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
@@ -15,8 +17,19 @@ namespace SecureCore.Controllers
         public IActionResult Login(LoginInfo info)
         {
             var (hash, salt) = Authentication.HashPassword(info.Password);
+            var options = new CookieOptions
+            {
+                Domain = "copyrightcrusader.org",
+                Expires = DateTime.Now.AddDays(7),
+                HttpOnly = true,
+                Secure = true,
+                Path = "/",
+                SameSite = SameSiteMode.Strict
+            };
 
-            return Ok($"Session Key: {Authentication.CreateSessionId()}{Environment.NewLine}Password Hash: {hash}{Environment.NewLine}Salt: {salt}{Environment.NewLine}");
+            HttpContext.Response.Cookies.Append("Session", Authentication.CreateSessionToken(), options);
+
+            return Ok();
         }
     }
 }