isWebAuthCookieRequest property

bool get isWebAuthCookieRequest

Whether the request participates in cookie-based web auth transport (via the webAuthModeHeaderName header) and the server has a ServerpodConfig.authCookie configured.

True for both webAuthModeCookie and webAuthModeCookieTransport; whether the main auth cookie may authenticate the call is decided separately by the server from the strict webAuthModeCookie value.

When true the auth token should be issued as an HttpOnly cookie (see writeWebAuthCookie) and omitted from the response body, so it never reaches client-side JavaScript.

Implementation

bool get isWebAuthCookieRequest {
  if (serverpod.config.authCookie == null) return false;
  final authMode = request?.headers[webAuthModeHeaderName]?.firstOrNull;
  return authMode == webAuthModeCookie ||
      authMode == webAuthModeCookieTransport;
}