index.js
function _setCookieToken (cookies, cookieName, cookieDomain, token, payload) {
  const parts = token.split('.')
  const opts = { sameSite: 'lax', expires: new Date(payload.exp * 1000) }
  if (cookieDomain) {
    opts.domain = cookieDomain
    // to support subdomains we can't use the sameSite opt
    // we rely on our manual check of the origin
    delete opts.sameSite
  }
  cookies.set(cookieName, parts[0] + '.' + parts[1], { ...opts, httpOnly: false })
  cookies.set(cookieName + '_sign', parts[2], { ...opts, httpOnly: true })
}
function _setCookieToken (cookies, cookieName, cookieDomain, token, payload) {
  const parts = token.split('.')
  const opts = { sameSite: 'lax', expires: new Date(payload.exp * 1000) }
  if (cookieDomain) {
    opts.domain = cookieDomain
    // to support subdomains we can't use the sameSite opt
    // we rely on our manual check of the origin
    delete opts.sameSite
  }
  cookies.set(cookieName, parts[0] + '.' + parts[1], { ...opts, httpOnly: false })
  cookies.set(cookieName + '_sign', parts[2], { ...opts, httpOnly: true })
}
function _setCookieToken ( cookies , cookieName , cookieDomain , token , payload ) { const parts = token . split ( '.' ) const opts = { sameSite : 'lax' , expires : new Date ( payload . exp * 1000 ) } if ( cookieDomain ) { opts . domain = cookieDomain // to support subdomains we can't use the sameSite opt // we rely on our manual check of the origin delete opts . sameSite } cookies . set ( cookieName , parts [ 0 ] + '.' + parts [ 1 ] , { ... opts , httpOnly : false } ) cookies . set ( cookieName + '_sign' , parts [ 2 ] , { ... opts , httpOnly : true } ) }
Split JWT strategy, the signature is in a httpOnly cookie for XSS prevention the header and payload are not httpOnly to be readable by client all cookies use sameSite for CSRF prevention
Split JWT strategy the signature is in a httpOnly cookie for XSS prevention the header and payload are not httpOnly to be readable by client all cookies use sameSite for CSRF prevention