Unable to use httpOnly attribute for authCookie about nuxt-auth HOT 1 OPEN

I see your point - you want to attach cookies server-side instead of manually setting them on the client. This is very tricky due to the fact local provider works with both Nuxt/non-Nuxt backends and authentication markers (cookies, etc.) greatly differ between all of them.
useCookie is mostly used to preserve state (i.e. tokens) within the session and cookies being set on SSR is mostly a side-effect.
I agree that it's better if JS has no access to the cookie, however in that case we also have no reliable way of knowing the authentication state:

• SSR sees the cookie and says that a user is authenticated -> renders authenticated view;
• CSR hydrates but doesn't see the cookie -> hydration mismatch -> renders unauthenticated view.

Not relying on useCookie at the client means that authentication state needs to be correctly set on the server and then transferred and preserved in memory during the session. This is of course doable but requires noticeable effort to think through and implement. I would love to hear your take on how it can be implemented using known building blocks of Nuxt (like useCookie and useState).

Concepts are welcome

from nuxt-auth.