Fixes #1889

Changes

This PR introduces enhanced configuration options for session cookies, allowing for finer control over their attributes.

• Added new SessionCookieOptions:
  • domain: Specifies the Domain attribute for the session cookie.
  • transient: If true, the maxAge attribute is omitted, making the cookie a session cookie (deleted when the browser closes). Defaults to false.
• Added support for Environment Variables: The SDK now reads the following environment variables to configure session cookies, providing an alternative to direct configuration:
  • AUTH0_COOKIE_DOMAIN
  • AUTH0_COOKIE_PATH
  • AUTH0_COOKIE_TRANSIENT
  • AUTH0_COOKIE_HTTP_ONLY
  • AUTH0_COOKIE_SECURE
  • AUTH0_COOKIE_SAME_SITE
• Updated setChunkedCookie: Logic adjusted to handle the transient option by omitting maxAge.
• Updated Auth0Client: Initialization logic now incorporates values from environment variables as defaults if direct configuration is not provided.
• Updated AbstractSessionStore: Now passes domain and transient options during cookie configuration.

Testing

• Added comprehensive unit tests in src/server/chunked-cookies.test.ts to verify the correct behavior of the new domain and transient options for both single and chunked cookies.
• Existing tests pass.

Usage

You can configure the new cookie options either through environment variables or directly in the SDK initialization.

1. Using Environment Variables:

Set the desired environment variables in your .env.local file or your deployment environment:

# .env.local
AUTH0_SECRET='LONG_RANDOM_STRING'
AUTH0_BASE_URL='http://localhost:3000'
AUTH0_ISSUER_BASE_URL='https://your-tenant.auth0.com'
AUTH0_CLIENT_ID='YOUR_AUTH0_CLIENT_ID'
AUTH0_CLIENT_SECRET='YOUR_AUTH0_CLIENT_SECRET'

# New Cookie Options
AUTH0_COOKIE_DOMAIN='.example.com' # Set cookie for subdomains
AUTH0_COOKIE_PATH='/app'          # Limit cookie to /app path
AUTH0_COOKIE_TRANSIENT=true       # Make cookie transient (session-only)
AUTH0_COOKIE_SECURE=true          # Recommended for production
AUTH0_COOKIE_SAME_SITE='Lax'
AUTH0_COOKIE_HTTP_ONLY=true

The SDK will automatically pick up these values.

2. Using Auth0ClientOptions (App Router Example):

Configure the options directly when initializing the client handlers:

// app/api/auth/[auth0]/route.ts
import { handleAuth, handleLogin } from '@auth0/nextjs-auth0';

export const GET = handleAuth({
  login: handleLogin({
    authorizationParams: {
      audience: 'https://api.example.com/products' // or AUTH0_AUDIENCE
    }
  }),
  onError(req: Request, error: Error) {
    console.error(error);
  }
}, {
  session: {
    cookie: {
      domain: '.example.com',
      path: '/app',
      transient: true,
      httpOnly: true,
      secure: process.env.NODE_ENV === 'production',
      sameSite: 'Lax',
      // name: 'appSession', // Optional: custom cookie name
    }
  },
  secret: process.env.AUTH0_SECRET,
  baseURL: process.env.AUTH0_BASE_URL,
  clientID: process.env.AUTH0_CLIENT_ID,
  clientSecret: process.env.AUTH0_CLIENT_SECRET,
  issuerBaseURL: process.env.AUTH0_ISSUER_BASE_URL
});

Note: Options provided directly in Auth0ClientOptions take precedence over environment variables.