Tweaked refresh-token cookie's path and sameSite attributes.

This commit is contained in:
Jesse Brault 2024-08-07 08:42:03 -05:00
parent e2765c4a96
commit 96deeca6a4

View File

@ -15,8 +15,8 @@ public final class AuthController {
final ResponseCookie.ResponseCookieBuilder b = ResponseCookie.from("refresh-token") final ResponseCookie.ResponseCookieBuilder b = ResponseCookie.from("refresh-token")
.httpOnly(true) .httpOnly(true)
.secure(true) .secure(true)
.sameSite("Lax") .maxAge(maxAge)
.maxAge(maxAge); .path("/");
if (token != null) { if (token != null) {
b.value(token); b.value(token);
} }