HttpOnly Cookie Auth Test

Test login, refresh token, and logout with HttpOnly cookie mode.

Configuration

API Base URL

Cookie Mode: When enabled on server (USE_REFRESH_TOKEN_COOKIE=true), refresh token is sent as HttpOnly cookie instead of JSON response.

1. Login with Email & Password

Email

Password

2. Refresh Token

In cookie mode, refresh token is read from HttpOnly cookie automatically.

3. Validate Access Token

Access Token

4. Logout

Clears HttpOnly cookie on server.

Testing Tips:

Set USE_REFRESH_TOKEN_COOKIE=true in server .env
Set COOKIE_SECURE=true for production (requires HTTPS)
Set COOKIE_DOMAIN=.yourdomain.com for subdomain sharing
Use browser DevTools → Application → Cookies to inspect HttpOnly cookie
Cookie should have HttpOnly, Secure (if https), SameSite flags