cookies

Name: cookies
Author: FightTheStroke

Cookie handling, auth patterns, and CSRF rules

by FightTheStroke(0) 0 installs

Free

Free account. Installing gives you the manifest plus copy-paste snippets.

See reviews

About

Instruction file imported from FightTheStroke/MirrorBuddy (.github/instructions/cookies.instructions.md). Copyright stays with the author.

Cookie & Auth

Cookie Constants

ALWAYS import from @/lib/auth/cookie-constants (apps/web/src/lib/auth/cookie-constants.ts) — NEVER hardcode

Auth

User: validateAuth() | Admin: validateAdminAuth() | Visitor: validateVisitorId() NEVER read cookies directly with cookieStore.get()

CSRF

Server: requireCSRF(request) BEFORE auth | Client: csrfFetch() for mutations | Skip: public endpoints, CRON_SECRET

Security

httpOnly+Signed: mirrorbuddy-user-id | httpOnly: csrf-token, mirrorbuddy-visitor-id | Client: mirrorbuddy-user-id-client, mirrorbuddy-consent, mirrorbuddy-a11y

Reference: ADR 0075

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

# after Install: the listing is in your workspace's routing pool - a plan picks it for its slot
curl -s -X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

fightthestroke-mirrorbuddy-cookies-instructions.ocm.jsonjson

{
  "ocm": "1",
  "id": "fightthestroke-mirrorbuddy-cookies-instructions",
  "kind": "skill",
  "name": "cookies",
  "description": "Cookie handling, auth patterns, and CSRF rules",
  "publisher": "FightTheStroke",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "github-instructions"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Cookie handling, auth patterns, and CSRF rules"
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github-instructions",
      "repository": "https://github.com/FightTheStroke/MirrorBuddy",
      "path": ".github/instructions/cookies.instructions.md",
      "ref": "18204d3e67be536b6168405f887280ef802996c0",
      "url": "https://github.com/FightTheStroke/MirrorBuddy/blob/18204d3e67be536b6168405f887280ef802996c0/.github/instructions/cookies.instructions.md",
      "key": "FightTheStroke/MirrorBuddy/.github/instructions/cookies.instructions.md"
    },
    "applies_to": "apps/web/src/lib/auth/**/*,apps/web/src/app/api/**/*.ts"
  },
  "instructions": "# Cookie & Auth\n\n## Cookie Constants\n\nALWAYS import from `@/lib/auth/cookie-constants`\n(`apps/web/src/lib/auth/cookie-constants.ts`) — NEVER hardcode\n\n## Auth\n\nUser: `validateAuth()` | Admin: `validateAdminAuth()` | Visitor: `validateVisitorId()`\nNEVER read cookies directly with `cookieStore.get()`\n\n## CSRF\n\nServer: `requireCSRF(request)` BEFORE auth | Client: `csrfFetch()` for mutations | Skip: public endpoints, CRON_SECRET\n\n## Security\n\nhttpOnly+Signed: `mirrorbuddy-user-id` | httpOnly: `csrf-token`, `mirrorbuddy-visitor-id` | Client: `mirrorbuddy-user-id-client`, `mirrorbuddy-consent`, `mir",
  "cost": {
    "context_tokens": 173
  }
}

Fetch it by URL: GET /api/v1/registry/fightthestroke-mirrorbuddy-cookies-instructions/manifest?version=1.0.0