def set_auth_cookie(subject: str | Any, expires_delta: timedelta) -> Response:
 access_token = create_access_token(subject, expires_delta)
 response = JSONResponse(content={"message": "Login successful"})
 # Note: The secure flag on cookies ensures they're only sent over encrypted HTTPS connections. For local development (HTTP) set it to False
 response.set_cookie(
 key="http_only_auth_cookie",
 value=access_token,
 httponly=True,
 max_age=3600,
 expires=3600,
 samesite="lax",
 secure=True,
 domain=None,
 )
 return response
@router.post("/login/access-token")
def login_access_token(
 session: SessionDep, form_data: Annotated[OAuth2PasswordRequestForm, Depends()]
) -> JSONResponse:
 """
 OAuth2-compatible token login: get an access token for future requests (sent in an HTTP-only cookie)
 """
 user = crud.authenticate(
 session=session, email=form_data.username, password=form_data.password
 )
 if not user:
 raise HTTPException(status_code=400, detail="Incorrect email or password")
 elif not user.is_active:
 raise HTTPException(status_code=400, detail="Inactive user")
 access_token_expires = timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
 return security.set_auth_cookie(user.id, access_token_expires)