Allow setting custom cookie name instead of "authjs"

nextauthjs / next-auth

Authentication for the Web.

https://authjs.dev

ISC License

25k stars 3.53k forks source link

Allow setting custom cookie name instead of "authjs" #12199

Closed paramaggarwal closed 6 days ago

paramaggarwal commented 2 weeks ago

☕️ Reasoning

Currently the cookie is always authjs by default - this exposes the implementation detail of the cookie and advanced usecases should allow customising the name of the cookie to prevent malicious users from introspecting implementation details of the authentication mechanism used by a particular website.

🧢 Checklist

[x] Documentation
[x] Tests
[x] Ready to be merged

📌 Resources

vercel[bot] commented 2 weeks ago

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
auth-docs	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Nov 8, 2024 3:39am

1 Skipped Deployment

vercel[bot] commented 2 weeks ago

@paramaggarwal is attempting to deploy a commit to the authjs Team on Vercel.

A member of the Team first needs to authorize it.

balazsorban44 commented 6 days ago

Thanks, but this is already possible via the config.cookies option, we could rather improve its documentation. See: https://authjs.dev/reference/core#cookies and https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/index.ts/#L585-L599

paramaggarwal commented 6 days ago

Thanks, I'm aware of the config.cookies option - but it requires overriding every single cookie name separately and also handle the __Secure or __Host prefix addition when needed. My goal was to give a simple setting that allowed one to update just the main authjs part of the cookie name. This would be the most common usecase if you think about it.

We could also move my suggestion inside the config.cookies setting as config.cookies.name?