docs: function _getCookieToken (cookies, req, cookieName, cookieDomain, publicUrl) {
    let token = cookies.get(cookieName)
    if (!token) return null
    const reqOrigin = req.headers['origin']
    const originDomain = reqOrigin && new URL(reqOrigin).host
  
    // check that the origin of the request is part of the accepted domain
    if (reqOrigin && cookieDomain && originDomain !== cookieDomain && !originDomain.endsWith('.' + cookieDomain)) {
      debug(`A cookie was sent from origin ${reqOrigin} while cookie domain is ${cookieDomain}, ignore it`)
      return null
    }
    // or simply that it is strictly equal to current target if domain is unspecified
    // in this case we are also protected by sameSite
    if (reqOrigin && !cookieDomain && reqOrigin !== new URL(publicUrl).origin) {
      debug(`A cookie was sent from origin ${reqOrigin} while public url is ${publicUrl}, ignore it`)
      return null
    }
  
    // Putting the signature in a second token is recommended but optional
    // and we accept full JWT in id_token cooke
    const signature = cookies.get(cookieName + '_sign')
    if (signature && (token.match(/\./g) || []).length === 1) {
      token += '.' + signature
    }
    return token
  }