Default values: - cookieSecure: (if your API domain has https, then this is true, else false) - cookieSameSite: (If your API domain and website domain share the same top level domain, this is

lax

, else it's

none

) - sessionExpiredStatusCode: 401 - cookieDomain: (This is the hostame of the api domain you provide) - sessionRefreshFeature -> disableDefaultImplementation:

false

- errorHandlers -> our own error handlers - enableAntiCsrf: If the same site is

lax

, this is

false

, else it is true.