Delete client cookie with a domain scope

[kiyonlin]

Related with gofiber/fiber#1127

Once a cookie is set with a domain scope, c.Response.Header.DelClientCookie won't work anymore. Browser still keeps the cookie.

I made a runnable demo to elaborate this issue(should append 127.0.0.1 a.example.com to local host):

package main

import (
	"time"

	"github.com/valyala/fasthttp"
)

func main() {
	fasthttp.ListenAndServe(":3000", func(c *fasthttp.RequestCtx) {
		switch string(c.Path()) {
		case "/":
			cookie := fasthttp.AcquireCookie()
			cookie.SetKey("key")
			cookie.SetValue("value")
			cookie.SetHTTPOnly(true)
			cookie.SetDomain("a.example.com")
			cookie.SetExpire(time.Now().Add(time.Hour))
			c.Response.Header.SetCookie(cookie)
			fasthttp.ReleaseCookie(cookie)
			c.SetBodyString("set domain cookie")
		case "/clear":
			// custom deletion works

			//cookie := fasthttp.AcquireCookie()
			//cookie.SetKey("key")
			//cookie.SetDomain("a.example.com")
			//cookie.SetExpire(fasthttp.CookieExpireDelete)
			//c.Response.Header.SetCookie(cookie)
			//fasthttp.ReleaseCookie(cookie)

			// DelClientCookie does not work, browser does not delete cookie
			c.Response.Header.DelClientCookie("key")
			c.SetBodyString("clear cookie")
		}
	})
}

How about adding another function to delete client cookie like

func (h *ResponseHeader) DelClientCookieWithDomain(key, domain string) {
	h.DelCookie(key)

	c := AcquireCookie()
	c.SetKey(key)
	c.SetDomain(domain)
	c.SetExpire(CookieExpireDelete)
	h.SetCookie(c)
	ReleaseCookie(c)
}

Any ideas?

[erikdubbelboer]

I'm not sure. Then you also kinda need to add DelClientCookieWithPath and DelClientCookieWithDomainAndPath. I think the current DelClientCookie is a good example of how to delete a cookie. If people need to delete cookies with domains or paths they can easily implement this themselves.

[kiyonlin]

@erikdubbelboer I've tested path which isn't counted as a scope(I don't know why).

[erikdubbelboer]

Hmm I didn't know that. In that case a pull request to add DelClientCookieWithDomain is welcome.

[kiyonlin]

I will test all cookie fields, and if only domain affects deletion, I will make a pull request.

[kiyonlin]

@erikdubbelboer Bad luck, both domain and path affect deletion. I must missed something in yesterday's test.
DelClientCookieWithDomain is not a good idea. But should we document this case in DelClientCookie?

[erikdubbelboer]

Thanks for the research. Yes let's document it. Can you make a pull?

[kiyonlin]

Sure.

[erikdubbelboer]

See: #956