Paradigm

Essentials

Cookies

Cookies are read from the incoming event and written on the outgoing response, both through a small, uniform API. As with everything else, your handler works with values, not with raw header strings.

#Reading cookies

app/Session.tsts

show (event: IncomingHttpEvent) {
  const theme = event.cookies.get('theme', 'light')   // name, default
  const seen = event.cookies.has('seen')
  return { theme, seen }
}

#Setting cookies

Set a cookie on a response, with the options a cookie should have in production: an expiry, httpOnly, secure, and a sameSite policy.

app/Session.tsts

import { jsonHttpResponse } from '@stone-js/http-core'

const response = jsonHttpResponse({ ok: true })
response.setCookie('theme', 'dark', {
  maxAge: 60 * 60 * 24 * 365,   // one year, in seconds
  httpOnly: true,
  secure: true,
  sameSite: 'lax'
})
return response

Option	Type	Default	Description
maxAge	`number`	·	Lifetime in seconds.
expires	`Date`	·	Absolute expiry (alternative to maxAge).
httpOnly	`boolean`	`false`	Hide the cookie from client-side JavaScript.
secure	`boolean`	`false`	Send only over HTTPS.
sameSite	`'strict' \| 'lax' \| 'none'`	`'lax'`	Cross-site sending policy.
path	`string`	`'/'`	The paths the cookie applies to.
domain	`string`	·	The host the cookie is scoped to.