Method sessionCookie

apps/server/internal/httpserver/security.go:400–413

(r *http.Request, token string, expiresAt time.Time)

}

func (s *Server) sessionCookie(r *http.Request, token string, expiresAt time.Time) *http.Cookie {
	cookie := &http.Cookie{
		Name:     sessionCookieName,
		Value:    token,
		Path:     "/api",
		HttpOnly: true,
		SameSite: http.SameSiteStrictMode,
		Expires:  expiresAt,
	}
	if s.effectiveScheme(r) == "https" {
		cookie.Secure = true
	}
	return cookie
}

func (s *Server) clearSessionCookie(r *http.Request) *http.Cookie {
	cookie := s.sessionCookie(r, "", time.Unix(0, 0))