fix(auth): logout clears guest cookie#2
Merged
Merged
Conversation
Guests had no working logout. The client called GET /api/auth/logout which routes to magnova-auth's federated signout — guests have no magnova session, so they bounced through an external provider that returned indeterminate state and landed back on graphini with their graphini_guest_id cookie still set. validateSessionOrGuest then re-created the same guest user on the next request, making logout a no-op. Two changes: 1. POST /api/auth/logout now clears both graphini_session AND graphini_guest_id (via the existing clearGuestCookieHeader helper). Idempotent — either or both may be present; clearing both is safe. GET still serves federated signout for OAuth users who specifically want their upstream session terminated. 2. authStore.logout() POSTs instead of GETs. The POST response carries the Set-Cookie that actually removes the cookies; we then window.location.href = '/' to force a clean reload. The previous client-side `document.cookie = 'graphini_session=; Path=/; Max-Age=0'` was redundant (server clears it) and never touched the guest cookie (which is HttpOnly, not deletable from JS anyway). The federated-signout GET path stays for completeness; nothing in the current UI calls it. If we want OAuth users to also terminate their magnova session at logout, a separate authStore.federatedLogout() can be added later. Reuses clearGuestCookieHeader and clearLocalSessionCookie from $lib/server/auth — no new server primitives.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Guests had no working logout. Clicking sign-out hit GET /api/auth/logout → magnova-auth federated signout → no magnova session for a guest → bounced back, guest cookie still set → validateSessionOrGuest re-created the same guest user → infinite "logged in as guest" state.
Two-line fix really:
GET path stays for federated OAuth signout. Nothing currently calls it; available if we add a "sign out everywhere" affordance later.
Test plan