79133273

Date: 2024-10-28 12:00:30
Score: 0.5
Natty:
Report link

What you can do to avoid refresh token being sent to every request is to ensure it is only sent to specific path, for example:

res.cookie('refreshToken', refreshToken, {
  httpOnly: true,
  secure: true,
  sameSite: 'Strict',
  path: '/refresh-token' // this cookie will only be sent with requests /refresh-token
});

res.cookie('accessToken', accessToken, {
  httpOnly: true,
  secure: true,
  sameSite: 'Strict'
});
Reasons:
  • Has code block (-0.5):
  • Starts with a question (0.5): What you can
  • Low reputation (0.5):
Posted by: Mathe