WebAuthCookieConfig class

Configuration for the cookie used to carry the web authentication token.

domain and path are plain strings. sameSite controls cross-site behaviour. Defaults are suitable for first-party web apps over HTTPS: host-only domain, path: /, secure: true, sameSite: lax.

Available extensions

• WebAuthCookieBuilder

Constructors

WebAuthCookieConfig({String name = defaultName, String? refreshName, String? domain, String path = '/', bool secure = true, CookieSameSite sameSite = CookieSameSite.lax})

Creates a new WebAuthCookieConfig.

const

Properties

domain → String?

The domain the cookie applies to. Null (the default) makes it host-only; set a registrable domain (e.g. .example.com) to share across subdomains.

final

hashCode → int

The hash code for this object.

no setter, inherited

name → String

The name of the cookie.

final

path → String

The path the cookie applies to. Defaults to /.

final

refreshName → String

The name of the refresh cookie used by JWT cookie-mode auth.

final

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

sameSite → CookieSameSite

The SameSite attribute. Defaults to CookieSameSite.lax.

final

secure → bool

Whether the cookie is only sent over secure (HTTPS) connections. Defaults to true.

final

Methods

buildClearCookieHeader() → SetCookie

Available on WebAuthCookieConfig, provided by the WebAuthCookieBuilder extension

A Set-Cookie that expires (removes) the auth cookie on the client. The attributes match those used to set it, which browsers require to remove a cookie.

buildClearRefreshCookieHeader({String? path}) → SetCookie

Available on WebAuthCookieConfig, provided by the WebAuthCookieBuilder extension

A Set-Cookie that expires (removes) the JWT refresh cookie. path must match the path the cookie was set with.

buildSetCookieHeader(String token, {int? maxAgeSeconds}) → SetCookie

Available on WebAuthCookieConfig, provided by the WebAuthCookieBuilder extension

A Set-Cookie that stores token as the auth cookie. When maxAgeSeconds is given it sets the cookie lifetime; omit it for a session cookie (cleared when the browser closes).

buildSetRefreshCookieHeader(String refreshToken, {int? maxAgeSeconds, String? path}) → SetCookie

Available on WebAuthCookieConfig, provided by the WebAuthCookieBuilder extension

A Set-Cookie that stores refreshToken as the JWT refresh cookie. path overrides the configured cookie path (see WebAuthCookieSession.writeWebAuthRefreshCookie).

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

toString() → String

A string representation of this object.

override

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Constants

defaultName → const String

The default cookie name.