diff --git a/include/authentication.hpp b/include/authentication.hpp
index e6e699c..2c3a08a 100644
--- a/include/authentication.hpp
+++ b/include/authentication.hpp
@@ -1,5 +1,6 @@
 #pragma once
 
+#include "cookies.hpp"
 #include "forward_unauthorized.hpp"
 #include "http_request.hpp"
 #include "http_response.hpp"
@@ -197,12 +198,7 @@
             return sp;
         }
         // TODO: change this to not switch to cookie auth
-        res.addHeader(boost::beast::http::field::set_cookie,
-                      "XSRF-TOKEN=" + sp->csrfToken +
-                          "; SameSite=Strict; Secure");
-        res.addHeader(boost::beast::http::field::set_cookie,
-                      "SESSION=" + sp->sessionToken +
-                          "; SameSite=Strict; Secure; HttpOnly");
+        bmcweb::setSessionCookies(res, *sp);
         res.addHeader(boost::beast::http::field::set_cookie,
                       "IsAuthenticated=true; Secure");
         BMCWEB_LOG_DEBUG(