webAuthBasePath property

String? get webAuthBasePath

The browser-visible base path the cookie-mode client declared via the webBasePathHeaderName header, or null when absent or malformed.

A prefix-stripping reverse proxy makes the browser-visible path differ from the path the server sees, and only the client knows the prefix (it is the path component of its host). Used to scope the refresh cookie's Path; a cookie Path is not a security boundary and only affects the sender's own cookie scope, so the client-supplied value is trusted after a format check. Normalized without a trailing slash (/ at the root).

Implementation

String? get webAuthBasePath {
  if (!isWebAuthCookieRequest) return null;
  final declared = request?.headers[webBasePathHeaderName]?.firstOrNull;
  if (declared == null || !_basePathRegExp.hasMatch(declared)) return null;
  final normalized = declared.replaceFirst(RegExp(r'/+$'), '');
  return normalized.isEmpty ? '/' : normalized;
}