Read http only cookie server side

al2o3cr · March 5, 2024, 7:13pm

The trick is mentioned in the docs for put_resp_cookie - the corresponding fetch_cookies call needs to specify which cookies are signed/encrypted.

For instance, here’s a spot that does it in phx.gen.auth’s code:

github.com/phoenixframework/phoenix

priv/templates/phx.gen.auth/auth.ex

546ee2fe6


      
          def fetch_current_<%= schema.singular %>(conn, _opts) do
            {<%= schema.singular %>_token, conn} = ensure_<%= schema.singular %>_token(conn)
            <%= schema.singular %> = <%= schema.singular %>_token && <%= inspect context.alias %>.get_<%= schema.singular %>_by_session_token(<%= schema.singular %>_token)
            assign(conn, :current_<%= schema.singular %>, <%= schema.singular %>)
          end
          
          defp ensure_<%= schema.singular %>_token(conn) do
            if token = get_session(conn, :<%= schema.singular %>_token) do
              {token, conn}
            else
              conn = fetch_cookies(conn, signed: [@remember_me_cookie])
          
              if token = conn.cookies[@remember_me_cookie] do
                {token, put_token_in_session(conn, token)}
              else
                {nil, conn}
              end
            end
          end
          
          @doc """