interface CookieAttributes
Since 0.2.0

Attributes controlling how a browser stores and returns a cookie.

Every field is optional, and an omitted field emits no attribute rather than a default. Callers that want a secure cookie must say so: this codec applies no policy of its own, because the session plugin owns those defaults.

Properties

readonly
optional
maxAge: number

Max-Age in seconds. 0 expires the cookie immediately (deletion).

readonly
optional
path: string

Path scope. Conventionally '/' for an application-wide cookie.

readonly
optional
domain: string

Domain scope. Omit for a host-only cookie, which is the safer default.

readonly
optional
expires: Date

Expires as an absolute date, for clients predating Max-Age.

readonly
optional
httpOnly: boolean

HttpOnly — hides the cookie from document.cookie.

readonly
optional
secure: boolean

Secure — the cookie is only sent over HTTPS.

readonly
optional
sameSite: "strict" | "lax" | "none"

SameSite policy. 'none' is invalid without Secure, so serializeCookie emits Secure alongside it rather than producing a cookie browsers discard.

Usage

import { type CookieAttributes } from "common/src/index.ts";