# isCookieAuthHost

**Kind:** Function

**Source:** [`atloria-monorepo/apps/web/src/app/p/[slugId]/lib/readerToken.ts`](https://github.com/sherkety/atloria/blob/main/atloria-monorepo/apps/web/src/app/p/[slugId]/lib/readerToken.ts#L28)

WEB-4: when on, the reader token is kept in an httpOnly cookie (set via the
same-origin /reader-api/session endpoint) instead of localStorage, so browser JS
— including any XSS — can't read it. OFF (default) preserves the legacy localStorage
behaviour. The slug→projectId map below stays in localStorage either way (non-secret).

HOST-SCOPED and RUNTIME: the middleware reads `READER_COOKIE_AUTH_HOSTS` (a comma-separated
allowlist, or `*`) at request time and sets a readable `atloria_ck=1` cookie on the docs
response for matching hosts. We just read that cookie here — so a staged rollout enables cookie
auth on one host (e.g. a custom domain) via `kubectl set env` (no rebuild), can't affect any
other gated docs, and rolls back instantly by removing the host from the env.

## Signature

```ts
function isCookieAuthHost(): boolean
```

**Returns:** `boolean`