bugfix: respect path configuration when deleting cookies (#2250)

Author: tusharpandey13

package.json

@@ -6,8 +6,8 @@
   "scripts": {
     "build": "tsc",
     "build:watch": "tsc -w",
-    "test:unit": "vitest",
-    "test:coverage": "vitest run --coverage",
+    "test:unit": "vitest --run",
+    "test:coverage": "vitest run --run --coverage",
     "test:e2e": "playwright test",
     "prepack": "pnpm run build",
     "install:examples": "pnpm install --filter ./examples/with-next-intl --shamefully-hoist && pnpm install --filter ./examples/with-shadcn --shamefully-hoist",

src/server/base-path-logout-integration.test.ts

@@ -141,7 +141,7 @@ describe("Base path and cookie configuration tests", () => {
     });
 
     it("should delete cookie with specified path", () => {
-      deleteCookie(mockResCookies, "test-cookie", "/dashboard");
+      deleteCookie(mockResCookies, "test-cookie", { path: "/dashboard" });
 
       const cookieHeader = mockResCookies.toString();
       expect(cookieHeader).toContain("test-cookie=");
@@ -150,7 +150,7 @@ describe("Base path and cookie configuration tests", () => {
     });
 
     it("should delete cookie with root path explicitly", () => {
-      deleteCookie(mockResCookies, "test-cookie", "/");
+      deleteCookie(mockResCookies, "test-cookie", { path: "/" });
 
       const cookieHeader = mockResCookies.toString();
       expect(cookieHeader).toContain("test-cookie=");
@@ -171,7 +171,7 @@ describe("Base path and cookie configuration tests", () => {
         mockReqCookies,
         mockResCookies,
         false,
-        "/dashboard"
+        { path: "/dashboard" }
       );
 
       const cookieHeader = mockResCookies.toString();
@@ -373,7 +373,9 @@ describe("Base path and cookie configuration tests", () => {
     });
 
     it("should handle empty path correctly", () => {
-      deleteCookie(new ResponseCookies(new Headers()), "test-cookie", "");
+      deleteCookie(new ResponseCookies(new Headers()), "test-cookie", {
+        path: ""
+      });
 
       // Should not throw and should create valid cookie deletion
       expect(true).toBe(true);

src/server/chunked-cookies.test.ts

@@ -340,6 +340,7 @@ describe("Chunked Cookie Utils", () => {
         expect.objectContaining({ domain: "example.com" })
       );
       expect(resCookies.set).toHaveBeenNthCalledWith(4, name, "", {
+        domain: "example.com",
         maxAge: 0,
         path: "/"
       });
@@ -560,8 +561,7 @@ describe("Chunked Cookie Utils", () => {
         deleteChunkedCookie(name, reqCookies, resCookies);
 
         expect(resCookies.set).toHaveBeenCalledWith(name, "", {
-          maxAge: 0,
-          path: "/"
+          maxAge: 0
         });
       });
 
@@ -581,25 +581,20 @@ describe("Chunked Cookie Utils", () => {
         // Should delete main cookie and 3 chunks
         expect(resCookies.set).toHaveBeenCalledTimes(4);
         expect(resCookies.set).toHaveBeenCalledWith(name, "", {
-          maxAge: 0,
-          path: "/"
+          maxAge: 0
         });
         expect(resCookies.set).toHaveBeenCalledWith(`${name}__0`, "", {
-          maxAge: 0,
-          path: "/"
+          maxAge: 0
         });
         expect(resCookies.set).toHaveBeenCalledWith(`${name}__1`, "", {
-          maxAge: 0,
-          path: "/"
+          maxAge: 0
         });
         expect(resCookies.set).toHaveBeenCalledWith(`${name}__2`, "", {
-          maxAge: 0,
-          path: "/"
+          maxAge: 0
         });
         // Should not delete unrelated cookies
         expect(resCookies.set).not.toHaveBeenCalledWith("otherCookie", "", {
-          maxAge: 0,
-          path: "/"
+          maxAge: 0
         });
       });
     });

src/server/cookie-domain-deletion.test.ts

@@ -0,0 +1,65 @@
+import { RequestCookies, ResponseCookies } from "@edge-runtime/cookies";
+import { describe, expect, it } from "vitest";
+
+import { deleteChunkedCookie, deleteCookie } from "./cookies.js";
+
+describe("Cookie deletion with domain", () => {
+  it("should delete cookies without domain by default", () => {
+    const headers = new Headers();
+    const resCookies = new ResponseCookies(headers);
+
+    deleteCookie(resCookies, "__session");
+
+    const setCookieHeaders = headers.getSetCookie();
+    const sessionCookieHeader = setCookieHeaders.find((header) =>
+      header.includes("__session=")
+    );
+
+    expect(sessionCookieHeader).toContain("Max-Age=0");
+    expect(sessionCookieHeader).not.toContain("Domain=");
+  });
+
+  it("should include domain when deleting cookies if domain option is provided", () => {
+    const headers = new Headers();
+    const resCookies = new ResponseCookies(headers);
+    const cookieDomain = "df.mydomain.com";
+
+    deleteCookie(resCookies, "__session", {
+      domain: cookieDomain,
+      path: "/"
+    });
+
+    const setCookieHeaders = headers.getSetCookie();
+    const sessionCookieHeader = setCookieHeaders.find((header) =>
+      header.includes("__session=")
+    );
+
+    expect(sessionCookieHeader).toContain(`Domain=${cookieDomain}`);
+    expect(sessionCookieHeader).toContain("Max-Age=0");
+  });
+
+  it("should delete chunked cookies with domain when provided", () => {
+    const headers = new Headers();
+    const reqCookies = new RequestCookies(headers);
+    const resCookies = new ResponseCookies(headers);
+
+    reqCookies.set("__session__0", "chunk0");
+    reqCookies.set("__session__1", "chunk1");
+
+    const cookieDomain = "df.mydomain.com";
+
+    deleteChunkedCookie("__session", reqCookies, resCookies, false, {
+      domain: cookieDomain,
+      path: "/"
+    });
+
+    const setCookieHeaders = headers.getSetCookie();
+
+    setCookieHeaders.forEach((header) => {
+      expect(header).toContain(`Domain=${cookieDomain}`);
+      expect(header).toContain("Max-Age=0");
+    });
+
+    expect(setCookieHeaders.length).toBeGreaterThanOrEqual(3);
+  });
+});

src/server/cookies.ts

@@ -225,8 +225,12 @@ export function setChunkedCookie(
     reqCookies.set(name, value);
 
     // When we are writing a non-chunked cookie, we should remove the chunked cookies
+    // Remove any previously stored chunks for this cookie name
     getAllChunkedCookies(reqCookies, name).forEach((cookieChunk) => {
-      deleteCookie(resCookies, cookieChunk.name, finalOptions.path);
+      deleteCookie(resCookies, cookieChunk.name, {
+        path: finalOptions.path,
+        domain: finalOptions.domain
+      });
       reqCookies.delete(cookieChunk.name);
     });
 
@@ -251,18 +255,23 @@ export function setChunkedCookie(
   // clear unused chunks
   const chunks = getAllChunkedCookies(reqCookies, name);
   const chunksToRemove = chunks.length - chunkIndex;
-
   if (chunksToRemove > 0) {
     for (let i = 0; i < chunksToRemove; i++) {
       const chunkIndexToRemove = chunkIndex + i;
       const chunkName = `${name}${CHUNK_PREFIX}${chunkIndexToRemove}`;
-      deleteCookie(resCookies, chunkName, finalOptions.path);
+      deleteCookie(resCookies, chunkName, {
+        path: finalOptions.path,
+        domain: finalOptions.domain
+      });
       reqCookies.delete(chunkName);
     }
   }
 
   // When we have written chunked cookies, we should remove the non-chunked cookie
-  deleteCookie(resCookies, name, finalOptions.path);
+  deleteCookie(resCookies, name, {
+    path: finalOptions.path,
+    domain: finalOptions.domain
+  });
   reqCookies.delete(name);
 }
 
@@ -323,19 +332,21 @@ export function getChunkedCookie(
  * @param name - The name of the main cookie to delete.
  * @param reqCookies - The request cookies object containing all cookies from the request.
  * @param resCookies - The response cookies object to manipulate the cookies in the response.
+ * @param isLegacyCookie - Whether to handle legacy cookie format.
+ * @param options - Options for cookie deletion including domain and path.
  */
 export function deleteChunkedCookie(
   name: string,
   reqCookies: RequestCookies,
   resCookies: ResponseCookies,
   isLegacyCookie?: boolean,
-  path?: string
+  options?: Pick<CookieOptions, "domain" | "path">
 ): void {
   // Delete main cookie
-  deleteCookie(resCookies, name, path);
+  deleteCookie(resCookies, name, options);
 
   getAllChunkedCookies(reqCookies, name, isLegacyCookie).forEach((cookie) => {
-    deleteCookie(resCookies, cookie.name, path); // Delete each filtered cookie
+    deleteCookie(resCookies, cookie.name, options); // Delete each filtered cookie
   });
 }
 
@@ -358,13 +369,29 @@ export function addCacheControlHeadersForSession(res: NextResponse): void {
   res.headers.set("Expires", "0");
 }
 
+/**
+ * Deletes a cookie from the response with optional domain and path specifications.
+ *
+ * @param resCookies - The response cookies object to manipulate.
+ * @param name - The name of the cookie to delete.
+ * @param options - Optional domain and path settings for cookie deletion.
+ */
 export function deleteCookie(
   resCookies: ResponseCookies,
   name: string,
-  path?: string
+  options?: Pick<CookieOptions, "domain" | "path">
 ) {
-  resCookies.set(name, "", {
-    maxAge: 0, // Ensure the cookie is deleted immediately
-    path: path || "/"
-  });
+  const deleteOptions: { maxAge: number; domain?: string; path?: string } = {
+    maxAge: 0 // Ensure the cookie is deleted immediately
+  };
+
+  if (options?.domain) {
+    deleteOptions.domain = options.domain;
+  }
+
+  if (options?.path) {
+    deleteOptions.path = options.path;
+  }
+
+  resCookies.set(name, "", deleteOptions);
 }

src/server/logout-cookie-domain.flow.test.ts

@@ -0,0 +1,106 @@
+import { ResponseCookies } from "@edge-runtime/cookies";
+import { describe, expect, it } from "vitest";
+
+import { StatelessSessionStore } from "./session/stateless-session-store.js";
+
+describe("Session cookie domain deletion bug", () => {
+  it("should delete session cookies with domain when AUTH0_COOKIE_DOMAIN is set", () => {
+    // Create session store with domain configured
+    const sessionStore = new StatelessSessionStore({
+      secret: "a-very-long-secret-that-is-at-least-32-characters-long",
+      cookieOptions: {
+        domain: "df.mydomain.com", // This simulates AUTH0_COOKIE_DOMAIN
+        path: "/",
+        secure: true,
+        sameSite: "lax"
+      }
+    });
+
+    // Mock request and response cookies
+    const headers = new Headers();
+    const reqCookies = new Headers();
+    const resCookies = new ResponseCookies(headers);
+
+    // Add session cookie to request (simulate existing session)
+    reqCookies.set("__session", "existing-session-value");
+
+    // Mock request cookies to properly simulate RequestCookies interface
+    const mockReqCookies = {
+      get: (name: string) => ({ value: reqCookies.get(name) }),
+      getAll: () =>
+        Array.from(reqCookies.entries()).map(([name, value]) => ({
+          name,
+          value
+        })),
+      set: (name: string, value: string) => reqCookies.set(name, value),
+      delete: (name: string) => reqCookies.delete(name),
+      has: (name: string) => reqCookies.has(name)
+    };
+
+    // Call delete method
+    sessionStore.delete(mockReqCookies as any, resCookies);
+
+    // Check that cookies are deleted with domain
+    const setCookieHeaders = headers.getSetCookie();
+
+    // Should have at least one cookie deletion header
+    expect(setCookieHeaders.length).toBeGreaterThan(0);
+
+    // Find the session cookie deletion header
+    const sessionDeletionHeader = setCookieHeaders.find(
+      (header) => header.includes("__session=") && header.includes("Max-Age=0")
+    );
+
+    expect(sessionDeletionHeader).toBeDefined();
+
+    // This is the key assertion - cookie deletion should include domain
+    expect(sessionDeletionHeader).toContain("Domain=df.mydomain.com");
+    expect(sessionDeletionHeader).toContain("Max-Age=0");
+    expect(sessionDeletionHeader).toContain("Path=/");
+  });
+
+  it("should work without domain when AUTH0_COOKIE_DOMAIN is not set", () => {
+    // Create session store without domain (default behavior)
+    const sessionStore = new StatelessSessionStore({
+      secret: "a-very-long-secret-that-is-at-least-32-characters-long",
+      cookieOptions: {
+        path: "/",
+        secure: true,
+        sameSite: "lax"
+        // no domain specified
+      }
+    });
+
+    const headers = new Headers();
+    const reqCookies = new Headers();
+    const resCookies = new ResponseCookies(headers);
+
+    reqCookies.set("__session", "existing-session-value");
+
+    const mockReqCookies = {
+      get: (name: string) => ({ value: reqCookies.get(name) }),
+      getAll: () =>
+        Array.from(reqCookies.entries()).map(([name, value]) => ({
+          name,
+          value
+        })),
+      set: (name: string, value: string) => reqCookies.set(name, value),
+      delete: (name: string) => reqCookies.delete(name),
+      has: (name: string) => reqCookies.has(name)
+    };
+
+    sessionStore.delete(mockReqCookies as any, resCookies);
+
+    const setCookieHeaders = headers.getSetCookie();
+    const sessionDeletionHeader = setCookieHeaders.find(
+      (header) => header.includes("__session=") && header.includes("Max-Age=0")
+    );
+
+    expect(sessionDeletionHeader).toBeDefined();
+
+    // Should not include domain when none is configured
+    expect(sessionDeletionHeader).not.toContain("Domain=");
+    expect(sessionDeletionHeader).toContain("Max-Age=0");
+    expect(sessionDeletionHeader).toContain("Path=/");
+  });
+});