in src/main/java/org/apache/sling/auth/oauth_client/impl/SlingLoginCookieManager.java [97:111]
public void setLoginCookie(@NotNull HttpServletRequest request, @NotNull HttpServletResponse response,
@NotNull SlingRepository repository, @NotNull Credentials creds) {
long expires = System.currentTimeMillis() + this.sessionTimeout;
// get current authentication data, may be missing after first login
String authData = null;
try {
authData = tokenStore.encode(expires, ((OidcAuthCredentials)creds).getUserId());
} catch (NoSuchAlgorithmException|InvalidKeyException e) {
throw new RuntimeException(e);
}
String cookieValue = Base64.encodeBase64URLSafeString(authData.getBytes(StandardCharsets.UTF_8));
setCookie(request, response, cookieName, cookieValue, (int) (sessionTimeout / 1000));
}