juanbzpy / next-authentication

Authentication & Authorization library for the Next.js framework
MIT License
57 stars 9 forks source link

Handle `httponly` cookies #6

Closed juanbzpy closed 4 years ago

juanbzpy commented 5 years ago

next-authentication assumes that all cookies aren't httponly and this might cause conflicts.

For example, I'm working on a lambda function that only does OAuth and 302 redirects back to the web app with cookies in the headers, so that the Next.js app can grab on the first load. So the library I'm using sets the cookie setting httponly true by default and I think that's okay.

So instead of changing that security setting to false I'd like to figure out to handle this in the Frontend. It might not be possible, but I'll do some research first before adding any warning or so to the library.