I see... or I might have two different (prepared) cookie backends – one that uses the configured cookie_max_age (used when rememberMe is true) and one that has cookie_max_age hard-coded to None (used when rememberMe is false, thus only creating session cookies).

I will try that! Thank you!

Well, unfortunately I don't think this works. get_enabled_backends is only called in access auth dependencies, so the logic I put there has nothing to do with how the login auth router behaves. And when registering the auth router...

app.include_router(
    _fastapi_users.get_auth_router(_auth_backend_cookie),
    prefix="/auth/cookie",
)

...I can only pass one backend (_auth_backend_cookie in the example above), so I cannot influence the backend this router is using based on the request to /auth/cookie.

What I want is for the router that handles /auth/cookie to set the Set-Cookie response header with a Max-Age of cookie_max_age only if the request contains something like rememberMe (a form data field set to "true" or something), but respond with a Set-Cookie header without a set Max-Age (or Expires) in any other case (thus creating a session cookie).

Actually for this I don't need any logic in get_enabled_backends at all, because this has to happen when requesting the login endpoint – which does not have any user dependencies.

Sorry, I didn't fully understand your requirement at first.

So is your requirement only for the routes inside get_auth_router, or does it apply to other routes as well?

And you want to dynamically decide whether to set a session cookie based on a specific parameter in the request?

So is your requirement only for the routes inside get_auth_router, or does it apply to other routes as well?

Yes, it's only for the routes coming from get_auth_router – and specifically only for auth routers using a backend with a cookie transport and only for the login route (as that's the one sending the Set-Cookie header).

And you want to dynamically decide whether to set a session cookie based on a specific parameter in the request?

That's all I want. Let me give you an example:

Case 1:

• user logs in by sending username=foo, password=bar and persistent=false to /auth/cookie (a route backed by an auth backend with a cookie transport!)
• the response contains a Set-Cookie header with no Max-Age or Expires fields set (so a session cookie!)

Case 2:

• user logs in by sending username=foo, password=bar and persistent=true to /auth/cookie (same route as in case 1!)
• the response contains a Set-Cookie header with Max-Age set to whatever cookie_max_age is set to in the API (so a persistent cookie!)

Thanks for helping!

Since only the login route has this requirement, if it were me, I would rewrite the auth router. However, since the auth router can't be extended through inheritance, the only option is to copy and paste the code and modify it.

By passing the request to backend.login and subclassing AuthenticationBackend, you can achieve the desired behavior. But considering that, your idea of adding a parameter to CookieTransport might actually be the simpler approach.