Optional
domainThe domain for which the cookie is valid.
Example: "example.com"
Optional
durationHuman-readable duration string to set both expires
and maxAge
.
Supported units:
You can combine multiple units, e.g. "1d2h30m".
Ignored if maxAge
or expires
are already defined.
Optional
expiresExact expiration date of the cookie.
If provided, the cookie will be removed after this date.
Optional
httpMarks the cookie as inaccessible to JavaScript (document.cookie
).
Helps prevent XSS attacks.
Optional
maxNumber of seconds until the cookie expires.
Takes precedence over duration
if both are set.
Example: 3600 (1 hour)
Optional
pathThe path where the cookie is valid.
Defaults to "/" if not specified.
Example: "/api"
Optional
sameControls cross-site cookie behavior.
secure
).Optional
secureIndicates if the cookie should only be sent over HTTPS.
Recommended for all authentication cookies.
Options for configuring HTTP cookies.