Optional ReadonlydomainDomain scope. Omit for a host-only cookie, which is the safer default.
Optional ReadonlyexpiresExpires as an absolute date, for clients predating Max-Age.
Optional ReadonlyhttpHttpOnly — hides the cookie from document.cookie.
Optional ReadonlymaxMax-Age in seconds. 0 expires the cookie immediately (deletion).
Optional ReadonlypathPath scope. Conventionally '/' for an application-wide cookie.
Optional ReadonlysameSameSite policy. 'none' is invalid without Secure, so
serializeCookie emits Secure alongside it rather than
producing a cookie browsers discard.
Optional ReadonlysecureSecure — the cookie is only sent over HTTPS.
Attributes controlling how a browser stores and returns a cookie.
Every field is optional, and an omitted field emits no attribute rather than a default. Callers that want a secure cookie must say so: this codec applies no policy of its own, because the session plugin owns those defaults.
Since
0.2.0