Move refresh token to an httpOnly cookie, keep access token in memory (#5) - #14

Merged

dsbaars merged 3 commits into

mainfrom

fix/security-httponly-refresh-cookie

Jun 24, 2026

Commits on Jun 24, 2026

feat(auth): keep refresh token in an httpOnly cookie, access token in memory
dsbaars
committed
a063cae
fix(auth): harden cookie clear + logout race, document/test cookie auth (#5 follow-up)
dsbaars
committed
e1753ab
test(web): e2e smoke for httpOnly refresh cookie restore + logout (#5)
dsbaars
committed
c8ec103