isCookieAuthHost

Kind: Function

Source: atloria-monorepo/apps/web/src/app/p/[slugId]/lib/readerToken.ts

WEB-4: when on, the reader token is kept in an httpOnly cookie (set via the same-origin /reader-api/session endpoint) instead of localStorage, so browser JS — including any XSS — can't read it. OFF (default) preserves the legacy localStorage behaviour. The slug→projectId map below stays in localStorage either way (non-secret).

HOST-SCOPED and RUNTIME: the middleware reads READER_COOKIE_AUTH_HOSTS (a comma-separated allowlist, or *) at request time and sets a readable atloria_ck=1 cookie on the docs response for matching hosts. We just read that cookie here — so a staged rollout enables cookie auth on one host (e.g. a custom domain) via kubectl set env (no rebuild), can't affect any other gated docs, and rolls back instantly by removing the host from the env.

Signature

ts
function isCookieAuthHost(): boolean

Returns: boolean