Nexus API Reference

CookieTokenExtractor
in package
implements TokenExtractor

Read onlyYes
FinalYes
Tags
psalm-api

Reads a token from a cookie. The cookie value is treated as-is — if you use signed cookies, verify the signature inside the Authenticator.

SECURITY: a cookie bearer token is attached by the browser to cross-site requests and WebSocket upgrades automatically, so on its own it is vulnerable to CSRF and cross-site WebSocket hijacking. When you set the cookie, mark it HttpOnly, Secure, and SameSite=Strict (or Lax), and protect state-changing routes and WebSocket upgrades with OriginAllowlistMiddleware (and a CSRF token for defense in depth). This extractor only reads the value; it cannot enforce those properties.

Table of Contents

Interfaces

TokenExtractor

Methods

__construct()  : mixed
extract()  : string|null

Methods

__construct()

public __construct(string $cookieName) : mixed
Parameters
$cookieName : string

extract()

public extract(ServerRequestInterface $request) : string|null
Parameters
$request : ServerRequestInterface
Attributes
#[Override]
Return values
string|null
On this page

Search results