Enforce encrypted transport for authentication cookies
Production deployment served over HTTPS
Auth.js · Pipe
useSecureCookies
useSecureCookies controls whether Auth.js cookies require HTTPS. It defaults to false for HTTP URLs and true for HTTPS sites.
How it works
Set useSecureCookies to true to make every cookie issued by Auth.js accessible only over HTTPS. Auth.js otherwise derives the default from the URL scheme: it permits non-secure cookies for HTTP development URLs and uses secure cookies for HTTPS sites.
Syntax
useSecureCookies?: boolean;Parameters
| Name | Type | Description |
|---|---|---|
useSecureCookies | boolean | Whether Auth.js cookies must be accessible only from HTTPS URLs. |
Key points
- A
truevalue restricts every Auth.js cookie to HTTPS access. - HTTP URLs default the option to
false, which supports local development. - The default flips according to whether the site uses HTTP or HTTPS.
- The setting applies globally to cookies issued by Auth.js rather than to one named cookie.
Common mistakes
- Setting the option to
falsepermits cookies on non-HTTPS URLs and weakens the protection; the documentation does not recommend doing so. - Treat this as an advanced configuration setting because it can have complex implications or side effects.
Example: Require secure cookies
import NextAuth from "next-auth";
export const { handlers, auth } = NextAuth({
useSecureCookies: true,
});Enables HTTPS-only access for cookies issued by Auth.js.
When to use it
Allow the documented development default
Local development on an HTTP localhost URL
Make transport requirements visible in configuration
Explicitly aligning cookie behavior with deployment URL scheme
Interview questions
QWhat does useSecureCookies control?
It is a boolean Auth.js configuration option. When enabled, all cookies created by Auth.js are restricted to HTTPS URLs.
Follow-up: What happens if the option is omitted? Auth.js chooses false for HTTP URLs and true for HTTPS URLs.
QWhat value does Auth.js use by default?
The default is scheme-dependent: HTTP URLs, including local development examples such as http://localhost:3000, receive false; HTTPS sites receive true. This provides development convenience without requiring an explicit override.
Follow-up: Why might local development behave differently from production? Because local HTTP URLs default to non-secure cookies, while production HTTPS URLs default to secure cookies.
QCan the setting be disabled?
Yes, but the documented override is intended for disabling the security feature, allowing cookies to be accessed from non-secured URLs. The documentation explicitly marks this choice as not recommended.
Follow-up: What safer production choice follows from the documentation? Keep secure-cookie behavior enabled when serving the application over HTTPS.
Related
cookiessecureCookieCookiesOptionsCookieOption