Function GetRefreshTokenCookie

backend/api/auth/header.go:103–122

GetRefreshTokenCookie creates a cookie for the refresh token. token="" => unset (clears cookie) Path is "/" to allow logout to delete the token from database. Security is maintained via HttpOnly, Secure, and SameSite=Strict.

(origin, token string, duration time.Duration)

// Path is "/" to allow logout to delete the token from database.
// Security is maintained via HttpOnly, Secure, and SameSite=Strict.
func GetRefreshTokenCookie(origin, token string, duration time.Duration) *http.Cookie {
	if token == "" {
		return &http.Cookie{
			Name:    RefreshTokenCookieName,
			Value:   "",
			Expires: time.Unix(0, 0),
			Path:    "/",
		}
	}
	isHTTPS := strings.HasPrefix(origin, "https")
	return &http.Cookie{
		Name:     RefreshTokenCookieName,
		Value:    token,
		MaxAge:   int(duration.Seconds()),
		Path:     "/",
		HttpOnly: true,
		Secure:   isHTTPS,
		SameSite: http.SameSiteStrictMode,
	}
}

// GetRefreshTokenFromCookie extracts the refresh token from request headers.
func GetRefreshTokenFromCookie(header http.Header) string {