Let's finish up the cookie based authentication by implementing what is called login out a user and
you will learn how we can secure our cookies also.
So let's see.
So back to our file.
This is a route that you are going to use to play around with the configuration of our cookies.
So when I hit this route called Send Cookies, I'm going to set this cookie by name, John.
So let's have a look.
So for us, large signed cookies.
And when I check my console here.
And under application and cookies.
You can see that I have the name here and for this one I can change the name, whatever I want.
And that is why cookies are not all that secured.
And again, I can access the cookies using JavaScript that is making use of documents dot cookie and
cookie that I have the name here.
So if you want avoid using JavaScript to access our cookies, we are going to pass in additional configuration
to the cookie.
So the third segment is going to be our configuration option.
So here the first property is HTTP only and let's say to true.
So what does it mean?
This one means that cookies is only accessible through the server, meaning it cannot be accessed by
the client side JavaScript.
So if you make use of document or cookie, it will not work.
So now let's save it and let's refresh the application and let's go to the application tab and now I
have it here, so let's remove it.
And this time around let's refresh it and set new cookies.
And now you can see that under this tab we have HTTP only and we have the check mark.
So if I go to the console by using JavaScript to access it, we see that we have empty string, meaning
that I cannot have access to my cookie using JavaScript.
Then next key value you need to pass in is called the secured.
Secured is set to true.
So what does it mean?
It means that this cookie is only accessible through https.
And lastly is we can provide the expiration of the cookies.
We can say that after seven days or one day we won't remove the cookies, so how can we get the one
done?
So back to the configuration list, how are we going to do it?
We pass in what is called maximum edge, and for this one, if we want to have seven days, is going
to be 1000 milliseconds.
Times 60 seconds, times 24.
And then times seven, this one means, what, seven days?
So if we want to expire this one within seven days, this is the syntax.
And if we want to expire the cookie for one second, I'm going to remove this one.
It's going to be the one second, but let's maintain the seven days.
So this is a clue where we need to add additional 16 as that well.
So that is it.
So let's go ahead and then refresh it and then let's remove the cookie and try to send again.
And this time I run it.
We see that we have expiration.
It's going to expire 2022 at this time.
So that's how you can secure our cookies.
So the next video, let's go ahead and implement what is called logging out.