Function GetTokenCookie

backend/api/auth/header.go:15–41

token="" => unset

(ctx context.Context, stores *store.Store, licenseService *enterprise.LicenseService, workspaceID string, origin, token string)

// token="" => unset
func GetTokenCookie(ctx context.Context, stores *store.Store, licenseService *enterprise.LicenseService, workspaceID string, origin, token string) *http.Cookie {
	if token == "" {
		return &http.Cookie{
			Name:    AccessTokenCookieName,
			Value:   "",
			Expires: time.Unix(0, 0),
			Path:    "/",
		}
	}
	isHTTPS := strings.HasPrefix(origin, "https")
	// Cookie expiry matches the refresh token duration so that Refresh() can always
	// extract the workspace from the expired JWT, even after long idle periods.
	// The auth middleware rejects expired JWTs for API calls, so a stale cookie is harmless.
	// The cookie is only read by Refresh() which verifies the signature but skips expiry.
	cookieDuration := GetRefreshTokenDuration(ctx, stores, licenseService, workspaceID)
	return &http.Cookie{
		Name:    AccessTokenCookieName,
		Value:   token,
		Expires: time.Now().Add(cookieDuration),
		Path:    "/",
		// Http-only helps mitigate the risk of client side script accessing the protected cookie.
		HttpOnly: true,
		// See https://github.com/bytebase/bytebase/issues/31.
		Secure:   isHTTPS,
		SameSite: http.SameSiteStrictMode,
	}
}

func GetAccessTokenDuration(ctx context.Context, store *store.Store, licenseService *enterprise.LicenseService, workspaceID string) time.Duration {
	accessTokenDuration := DefaultAccessTokenDuration