Login

writeJwt(userinfo) Last updated: 15. Oct 2026

API only function

The writeJwt function generates a signed JWT (JSON Web Token) and writes it as a session cookie (access_token) to the user's browser. Write a NULL value to log the user out.

The token is only valid on the day it was issued (server time). After midnight request.Jwt is null and the user must log in again. The cookie is a session cookie, so it also disappears when the browser is closed.

See also: deleteJwt denyAccess logOut flagActivity getProfilePictureUrl Custom JWT login example

Parameters

Name Type Description
userinfo object

A JSON object with the information about the user you need in later requests.
The token is signed, not encrypted: the user can read its content, so never put secrets in it.

Returns

True if successful.

Security details

The token is signed — not encrypted, so anyone holding it can read the payload — and validated server-side using HMAC-SHA256 with a per-site secret key (PublishedFolder.JwtSecret, 64 hex characters, auto-generated on first use and stored in the database, never exposed to the client) — so it cannot be forged without the server key.

The cookie is written with the following flags: HttpOnly=true (not accessible from JavaScript), Secure=true (only sent over HTTPS), and SameSite=Lax (protects against CSRF on cross-site POST/subrequests). On every request the token is decoded and its HMAC recomputed with the server key; if the signature does not match (tampered/forged token) it is rejected. A token whose issue date is not today is also rejected.

deleteJwt mirrors the Secure+SameSite flags so the cookie is overwritten consistently on logout.

Example

Code example (JS)

JS is normal JavaScript either running in the browser or on the Docly™ server. 
// Issue a session JWT cookie for the user
docly.writeJwt({ "username": username, "access": "admin" });

// In any other API function, read the cookie back via request.Jwt
if (request.Jwt.access != "admin")
    return docly.denyAccess();

// To log the user out again, write a NULL value (or call deleteJwt)
docly.writeJwt(null);


// *********************************
// A full login flow — with salted password hashes, POST only and
// brute-force flagging — is in the example "Create custom JWT login":
// /JavaScript/Examples/Custom-API/Create-custom-JWT-login
//
// Never compare a password hash sent by the browser: a hash sent by the
// client works exactly like a password. Hash the password on the server.