If the next-auth session cookie is httpOnly, how does next-auth know when it's logged in?

[yrokhlin]

Since Javascript can't touch and httpOnly cookie, how does next-auth know on the client that there is an active session?

[balazsorban44]

https://next-auth.js.org/getting-started/rest-api#get-apiauthsession
https://next-auth.js.org/getting-started/client#usesession
https://next-auth.js.org/getting-started/client#getsession

[yrokhlin]

No I understand which part of the next-auth API does this, I am asking specifically HOW that API works.
Like how does the actual mechanism work for detecting if the httpOnly cookie exists?
My apologies if the question was not immediately clear.

[balazsorban44]

look at the source code, it's open 😊