23 lines
637 B
TypeScript
23 lines
637 B
TypeScript
// The single browser-facing cookie. It holds only an opaque session id,
|
|
// never a Minnect token (ADR-001). httpOnly keeps it out of JavaScript.
|
|
|
|
export const SESSION_COOKIE = "mfb_session";
|
|
|
|
export interface SessionCookieOptions {
|
|
httpOnly: true;
|
|
secure: boolean;
|
|
sameSite: "lax";
|
|
path: "/";
|
|
}
|
|
|
|
export function sessionCookieOptions(): SessionCookieOptions {
|
|
return {
|
|
httpOnly: true,
|
|
// Secure is required in production (ADR-001). It is relaxed in local
|
|
// development so the cookie works over plain http on localhost.
|
|
secure: process.env.NODE_ENV !== "development",
|
|
sameSite: "lax",
|
|
path: "/",
|
|
};
|
|
}
|