WebAuthCookieBuilder extension

Builds the relic Set-Cookie headers for the web authentication cookie described by a WebAuthCookieConfig.

The auth cookie is always HttpOnly (the token must never be readable by JavaScript); secure, sameSite, domain and path come from the config.

on

• WebAuthCookieConfig

Methods

buildClearCookieHeader() → SetCookie

Available on WebAuthCookieConfig, provided by the WebAuthCookieBuilder extension

A Set-Cookie that expires (removes) the auth cookie on the client. The attributes match those used to set it, which browsers require to remove a cookie.

buildClearRefreshCookieHeader({String? path}) → SetCookie

Available on WebAuthCookieConfig, provided by the WebAuthCookieBuilder extension

A Set-Cookie that expires (removes) the JWT refresh cookie. path must match the path the cookie was set with.

buildSetCookieHeader(String token, {int? maxAgeSeconds}) → SetCookie

Available on WebAuthCookieConfig, provided by the WebAuthCookieBuilder extension

A Set-Cookie that stores token as the auth cookie. When maxAgeSeconds is given it sets the cookie lifetime; omit it for a session cookie (cleared when the browser closes).

buildSetRefreshCookieHeader(String refreshToken, {int? maxAgeSeconds, String? path}) → SetCookie

Available on WebAuthCookieConfig, provided by the WebAuthCookieBuilder extension

A Set-Cookie that stores refreshToken as the JWT refresh cookie. path overrides the configured cookie path (see WebAuthCookieSession.writeWebAuthRefreshCookie).