Class AuthCookies

Namespace

SEBT.Portal.Api.Services

Assembly

SEBT.Portal.Api.dll

Helper for the HttpOnly session cookie that carries the portal JWT. The JWT is never returned in response bodies or exposed to JavaScript — the browser transports it automatically via this cookie.

public static class AuthCookies

Inheritance

object

AuthCookies

Fields

AuthCookieName

Name of the HttpOnly cookie carrying the portal JWT.

public const string AuthCookieName = "sebt_portal_session"

Field Value

string

Methods

AllowsCookieAuthentication(PathString)

Whether the session cookie may be used to authenticate a request to the given path. The enrollment-checker API is anonymous by contract and is excluded: deployments can serve the checker from the portal's origin (CO production does), so a logged-in household's session cookie rides along on checker requests and would otherwise attach portal identity to anonymous enrollment-check logs.

public static bool AllowsCookieAuthentication(PathString requestPath)

Parameters

requestPath PathString

Returns

bool

ClearAuthCookie(HttpResponse)

Clears the session cookie; attributes must mirror SetAuthCookie(HttpResponse, string, DateTimeOffset) so the browser deletes it.

public static void ClearAuthCookie(HttpResponse response)

Parameters

response HttpResponse

SetAuthCookie(HttpResponse, string, DateTimeOffset)

Writes the portal JWT to the HttpOnly session cookie; expires with the token.

public static void SetAuthCookie(HttpResponse response, string token, DateTimeOffset expiresAt)

Parameters

response HttpResponse

token string

expiresAt DateTimeOffset