21 lines
684 B
JavaScript
21 lines
684 B
JavaScript
|
const COOKIE_NAME = 'token';
|
||
|
|
const isProd = process.env.NODE_ENV === 'production';
|
||
|
|
|
||
|
|
// httpOnly-Cookie statt Token in JS-lesbarem localStorage — verhindert dass ein XSS-Treffer
|
||
|
|
// das Session-Token einfach per document.cookie/localStorage ausliest.
|
||
|
|
function setAuthCookie(res, token, maxAgeMs = 8 * 60 * 60 * 1000) {
|
||
|
|
res.cookie(COOKIE_NAME, token, {
|
||
|
|
httpOnly: true,
|
||
|
|
secure: isProd,
|
||
|
|
sameSite: 'lax',
|
||
|
|
maxAge: maxAgeMs,
|
||
|
|
path: '/',
|
||
|
|
});
|
||
|
|
}
|
||
|
|
|
||
|
|
function clearAuthCookie(res) {
|
||
|
|
res.clearCookie(COOKIE_NAME, { httpOnly: true, secure: isProd, sameSite: 'lax', path: '/' });
|
||
|
|
}
|
||
|
|
|
||
|
|
module.exports = { setAuthCookie, clearAuthCookie, COOKIE_NAME };
|