Skip to main content

Function: buildCsrfCookie()

buildCsrfCookie(token, options?): string

Defined in: service-core/src/http/csrf/csrf.ts:85

Builds the Set-Cookie header value for the CSRF cookie. Pass an empty string for token to build a header that immediately clears the cookie instead (mirrors TokenUtils.buildCookie()'s own clearing convention in @rapidrest/auth).

Deliberately never emits a Domain attribute, even though the sibling jwt/refresh cookies often do — see this module's doc comment for why a wide-open Domain here would defeat the whole scheme. Deliberately never emits HttpOnly either: browser JavaScript reading this cookie and echoing it back as a header is the entire mechanism.

Parameters​

token​

string

options?​

CsrfCookieOptions = {}

Returns​

string