Variable: REFRESH_COOKIE_DEFAULTS

const REFRESH_COOKIE_DEFAULTS: object

Refresh-token cookie attributes. Scoped to the auth base path (/api/auth) so it reaches BOTH the refresh route (to rotate) and the logout route (to revoke, via possession-proof) while staying off GraphQL data traffic, which lives on a different path. The token is read only server-side and never reaches JavaScript. maxAge is the refresh-token lifetime (30 days); the backend body carries no refresh expiry, so the BFF route uses this constant.

The path must equal the route's mount base so logout receives the cookie — a narrower /api/auth/refresh would NOT be sent to /api/auth/logout (cookies are not sent to sibling paths), leaving the family un-revoked on logout.

Type Declaration

httpOnly

readonly httpOnly: true = true

maxAge

readonly maxAge: number

name

readonly name: "customerRefreshToken" = REFRESH_COOKIE_NAME

path

readonly path: "/api/auth" = '/api/auth'

sameSite

readonly sameSite: "lax"

secure

readonly secure: boolean = SECURE