I
CookieAttributes
Write-time cookie attributes (the Set-Cookie half of RFC 6265).
Cookies expose no way to read attributes back — these only describe how a
cookie is written (and must be repeated to overwrite or delete it, since a
cookie's identity is its name + domain + path).
interface CookieAttributes
| Property | Type | Default | Description |
|---|
path? | string | '/' | The path the cookie is scoped to. |
domain? | string | — | The domain the cookie is scoped to. Omitted = host-only cookie. |
maxAge? | number | — | Lifetime in seconds. Takes precedence over expires in browsers when both
are present (RFC 6265 §4.1.2.2). Non-positive values expire the cookie. |
expires? | Date | number | — | Expiry as a Date or Unix epoch milliseconds. Omitting both maxAge
and expires creates a session cookie. |
secure? | boolean | — | Only send the cookie over HTTPS. |
sameSite? | 'lax' | 'strict' | 'none' | 'lax' | SameSite attribute. 'none' requires secure: true — browsers silently
drop the cookie otherwise, so serializeCookie fails loudly instead. |
partitioned? | boolean | false | Partition the cookie by top-level site (CHIPS). Requires secure: true. |