How do I make the cookies HttpOnly?

[silentworks]

This is a copy of a troubleshooting article on Supabase's docs site. It may be missing some details from the original. View the original article.

This is not necessary. Both the access token and refresh token are designed to be passed around to different components in your application. The browser-based side of your application needs access to the refresh token to properly maintain a browser session anyway.