Function setAuthCookiesWithRemember

server-source-code/internal/handler/auth.go:406–441

setAuthCookiesWithRemember sets cookies; rememberMe uses 30-day refresh token. useLax forces SameSite=Lax (required for OIDC redirects from IdP). browserSessionCookies: when true, both cookies use MaxAge 0 (session cookies) so they are not persisted to disk and are dropped when the browser session e

(w http.ResponseWriter, r *http.Request, accessToken, refreshToken string, tokenMaxAge int64, rememberMe bool, env string, useLax bool, browserSessionCookies bool)

// browserSessionCookies: when true, both cookies use MaxAge 0 (session cookies) so they are not
// persisted to disk and are dropped when the browser session ends (close all windows / quit).
func setAuthCookiesWithRemember(w http.ResponseWriter, r *http.Request, accessToken, refreshToken string, tokenMaxAge int64, rememberMe bool, env string, useLax bool, browserSessionCookies bool) {
	secure := r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https"
	sameSite := http.SameSiteLaxMode
	if !useLax && env == "production" && secure {
		sameSite = http.SameSiteStrictMode
	}
	tokenCookieMaxAge := int(tokenMaxAge)
	if browserSessionCookies {
		tokenCookieMaxAge = 0
	}
	http.SetCookie(w, &http.Cookie{
		Name:     "token",
		Value:    accessToken,
		Path:     "/",
		MaxAge:   tokenCookieMaxAge,
		HttpOnly: true,
		Secure:   secure && env == "production",
		SameSite: sameSite,
	})
	refreshMaxAge := 7 * 24 * 3600 // 7 days
	if rememberMe {
		refreshMaxAge = 30 * 24 * 3600 // 30 days
	}
	if browserSessionCookies {
		refreshMaxAge = 0
	}
	http.SetCookie(w, &http.Cookie{
		Name:     "refresh_token",
		Value:    refreshToken,
		Path:     "/",
		MaxAge:   refreshMaxAge,
		HttpOnly: true,
		Secure:   secure && env == "production",
		SameSite: sameSite,
	})
}

// completeLogin creates tokens, optionally creates session for remember-me, sets cookies, returns JSON.
func (h *AuthHandler) completeLogin(w http.ResponseWriter, r *http.Request, user *models.User, rememberMe bool) {