[SDK-1418] Advanced option to clear transaction cookies on redirect

[stevehobbsdev]

Description

This PR adds an advanced option to clear transaction cookies on authorization redirect. The default value is false.

Usage:

await createAuth0Client({
  advancedOptions: {
    clearTransactionCookies: true
  }
})

References

Fixes #319

Testing

• This change adds integration tests
• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not master

[stevehobbsdev]

This PR is currently based on feature/advanced-default-scopes to get access to the AdvancedOptions type. Once #435 is merged, I will rebase.

[adamjmcgrath]

I have a couple of concerns

1. I don't think this will fix anyone's underlying issue. The only 2 examples of this I've seen are:

#387 Redirecting users from within rules which messed with the state param and caused a login loop (and the transaction can't be cleared if you have the wrong state param)

#319 This is a login loop as well (from the screenshot I estimate a new transaction every 300ms) and they have a custom property in their state "returnPath": "/scans?dateTimeRange=preset-lastDay&freeText=liron&origin=VOID&verdict=VOID" so perhaps they're trying to do something with redirecting in rules too?

For both these customers, if they had added the clearTransactionCookies option, the login loops would go on indefinitely rather than be stopped by the 494 - which I suppose might be preferable, as they don't have to be told to clear their cookies?

2. Enabling the option will cause concurrency issues with multiple tabs logging in at the same time - if you call loginWithRedirect from 2 tabs at the same time, the second one will invalidate the first one. This would definitely become an issue if you had a watchInactivity type process like in Cookie Pollution - still happening to us with latest version #319 (comment) that automatically called loginWithRedirect

That said, I don't have a better solution than finding and fixing the customers underlying issue and telling them to tell their users to clear their cookies - which I know is not very satisfactory...

[stevehobbsdev]

Closing this in favor of a different approach.