Cookies

Zinc uses the standard library’s http.Cookie type, so every attribute works exactly as it does in net/http.

Set a cookie

app.Post("/login", func(c *zinc.Context) error {
  token, err := auth.SignIn(c.Context(), c.PostForm("email"), c.PostForm("password"))
  if err != nil {
    return zinc.ErrUnauthorized
  }

  c.SetCookie(&http.Cookie{
    Name:     "session",
    Value:    token,
    Path:     "/",
    MaxAge:   int((24 * time.Hour).Seconds()),
    HttpOnly: true,                 // not readable from JavaScript
    Secure:   true,                 // HTTPS only
    SameSite: http.SameSiteLaxMode, // not sent on most cross-site requests
  })
  return c.NoContent()
})

For anything that identifies a user, set HttpOnly, Secure, and a SameSite mode. Browsers reject SameSite=None unless Secure is also set.

Read cookies

cookie, err := c.Cookie("session")
if errors.Is(err, http.ErrNoCookie) {
  return zinc.ErrUnauthorized.WithMessage("sign in required")
}
if err != nil {
  return err
}
user, err := auth.UserFromToken(c.Context(), cookie.Value)

c.Cookies() returns every cookie on the request.

Clear cookies

c.ClearCookie("session", "preferences")
return c.NoContent()

ClearCookie sends expired cookies with the given names, so the browser deletes them.

Related middleware

• Session stores small signed values in a cookie.
• CSRF protects cookie-authenticated forms and requests.
• JWT and Key Auth can read tokens from cookies.