I have a React + Nextjs application which uses NextAuth. I'm trying to set a refresh token in a cookie which works fine on localhost but doesn't work when deployed on to production (HTTPS). The function setting the cookie is shown below. Is there something that I've missed?
From [...nextauth].ts:
const setRefreshTokenCookie = (
cookies: Cookies,
refresh_token: string
): Cookies => {
const date = new Date();
const time = date.getTime();
const expireTime = time + 24 * 60 * 60 * 1000 * 90; // 90 days
date.setTime(expireTime);
const currentCookies = cookies.set(
`${useSecureCookies ? "__Host-" : ""}test.refresh-token`,
refresh_token,
{
sameSite: "strict",
overwrite: true,
expires: date,
httpOnly: useSecureCookies,
}
);
return currentCookies ;
};
Notes:
NextAuth's useSecureCookie
localhost cookies:
- test.csrf-token
- test.refresh-token
- test.callback-url
- test.session-token
production cookies:
- __Host-test.csrf-token
- __Secure-test.callback-url
- __Secure-test.session-token