Server Actions

When credentialStorageType is set to cookies during configuration, two server action files are generated in the actions/ directory. These actions manage session tokens and cookie storage on the server side, keeping sensitive credentials out of the browser.

Condition: credentialStorageType = cookies

Low-level cookie operations using the Next.js cookies() API. All functions are marked 'use server'.

The CookieOptions type supports:

type CookieOptions = {
  httpOnly: boolean;
  maxAge: number;
  priority: 'high' | 'low';
  sameSite: 'lax' | 'strict' | 'none';
  path: string;
  secure: boolean;
};

Each set/delete function returns both the updated cookies array and the header string, so callers can immediately use the new cookie state without a second read.

Higher-level session operations that communicate with the WooGraphQL backend. All functions are marked 'use server'.

Creates a new WooCommerce session or resumes an existing one. If an authToken is provided, it is sent as a Bearer token to associate the session with an authenticated user. The function reads the session token from the woocommerce-session response header (or from the customer's sessionToken/cartToken field, depending on configuration).

const sessionToken = await startSession(authToken);

Updates session data (e.g., shipping/billing addresses). Requires either an authToken or sessionToken. Both are sent as headers to the GraphQL endpoint.

const newSessionToken = await updateSession(
  { authToken, sessionToken },
  { shipping: { country: 'US', state: 'CA' } },
);

Exchanges a refresh token for a fresh auth token. Works with both WPGraphQL JWT Authentication and Headless Login plugins (the generated GraphQL mutation adapts based on the jwtAuthPlugin configuration).

const newAuthToken = await refreshAuthToken(refreshToken);

The cookie-based session flow works as follows:

1. The SessionProvider calls startSession() to initialize a WooCommerce session
2. The session token is stored in an HTTP-only cookie via setCookie()
3. Subsequent API route requests include cookies via getCookieHeader()
4. The GraphQL client reads cookies and attaches session headers to backend requests
5. When tokens expire, refreshAuthToken() obtains new credentials