Supabase SSR + Middleware + HttpOnly Cookies?
Hello
I’m currently working on my thesis project, it’s a patient record management system with appointment scheduling (using Next.js + Supabase).
I ran into an issue: the Supabase cookies aren’t set as HttpOnly, which makes me worried about security.
My question is:
Is there a way to still use Supabase SSR with middleware and have the cookies set as HttpOnly?
Or am I missing something about how Supabase auth/session handling works in this setup?
I’m still pretty new to web dev, so any clarification, suggestions, or best practices would really help me a lot.
Thanks!
also
I just want to ask: how can I properly justify that using a cookie without the HttpOnly flag can still be considered secure, especially when dealing with sensitive data such as patient records?
I’m currently working on my thesis project, it’s a patient record management system with appointment scheduling (using Next.js + Supabase).
I ran into an issue: the Supabase cookies aren’t set as HttpOnly, which makes me worried about security.
My question is:
Is there a way to still use Supabase SSR with middleware and have the cookies set as HttpOnly?
Or am I missing something about how Supabase auth/session handling works in this setup?
I’m still pretty new to web dev, so any clarification, suggestions, or best practices would really help me a lot.
Thanks!
also
I just want to ask: how can I properly justify that using a cookie without the HttpOnly flag can still be considered secure, especially when dealing with sensitive data such as patient records?
