Updated
How do I make the cookies HttpOnly?
This is not necessary. Both the access token and refresh token are designed to be passed around to different components in your application. The browser-based side of your application needs access to the refresh token to properly maintain a browser session anyway.
Related topics
- Server-side auth
- Advanced SSR guide
- Should I set a shorter max-age parameter on the cookies?
- Fetch requests to API endpoints are not showing the session