fix: cookie not being deleted correctly when basepath set #2223
Conversation
|
Thanks @mustafagft , we'll take a look and merge this if it looks correct 👍 |
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2223 +/- ##
==========================================
+ Coverage 84.23% 84.44% +0.21%
==========================================
Files 22 22
Lines 2208 2225 +17
Branches 397 409 +12
==========================================
+ Hits 1860 1879 +19
+ Misses 342 340 -2
Partials 6 6 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
src/server/base-path-logout.test.ts
Outdated
| import { describe, it, expect, beforeEach, afterEach } from "vitest"; | ||
| import { NextRequest } from "next/server.js"; | ||
| import { Auth0Client } from "./client.js"; | ||
| import { AuthClient } from "./auth-client.js"; |
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note
src/server/base-path-logout.test.ts
Outdated
| import { NextRequest } from "next/server.js"; | ||
| import { Auth0Client } from "./client.js"; | ||
| import { AuthClient } from "./auth-client.js"; | ||
| import { StatelessSessionStore } from "./session/stateless-session-store.js"; |
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note
src/server/base-path-logout.test.ts
Outdated
| import { Auth0Client } from "./client.js"; | ||
| import { AuthClient } from "./auth-client.js"; | ||
| import { StatelessSessionStore } from "./session/stateless-session-store.js"; | ||
| import { TransactionStore } from "./transaction-store.js"; |
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note
src/server/base-path-logout.test.ts
Outdated
| sid: "session_123" | ||
| }; | ||
|
|
||
| function getMockAuthorizationServer() { |
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note
src/server/client.ts
Outdated
| @@ -36,6 +36,7 @@ | |||
| TransactionCookieOptions, | |||
| TransactionStore | |||
| } from "./transaction-store.js"; | |||
| import { ensureLeadingSlash, normalizeWithBasePath } from "../utils/pathUtils.js"; | |||
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note
📋 Changes
Fixed: Cookie deletion during logout when
NEXT_PUBLIC_BASE_PATHis configuredThis PR addresses a critical bug where session and transaction cookies were not being properly cleared during logout when a Next.js application uses a base path configuration.
Key Changes:
Auth0Clientconstructor: Now automatically detectsNEXT_PUBLIC_BASE_PATHenvironment variable and configures cookie paths accordinglydeleteCookie,deleteChunkedCookie) now accept and use the correct path parameter to ensure cookies are cleared with the same path they were set withAuthClient: Added proper base path stripping and normalization to handle authentication routes correctly when base path is configuredAUTH0_COOKIE_PATHor client options) still take precedence over auto-detected base pathTypes and methods changed:
deleteCookie()- Added optionalpathparameterdeleteChunkedCookie()- Added optionalpathparameterAuth0Clientconstructor - Enhanced to auto-configure cookie paths based on base pathAuthClient.handler()- Added base path stripping logicBackward Compatibility: All changes are backward compatible. Applications without base path configuration continue to work exactly as before, using root path (
/) for cookies.📎 References
This fix addresses issues with Next.js applications deployed with base path configurations where users would remain logged in after attempting to logout because the session cookies were not being properly cleared.
Related to base path support added in #2167 and cookie deletion improvements in #2200.
🎯 Testing
Manual Testing Steps:
NEXT_PUBLIC_BASE_PATH="/dashboard"in environment variables/dashboard/auth/logout/dashboard)Automated Testing:
src/server/base-path-logout.test.ts- Comprehensive tests covering base path cookie configuration and logout scenariosauth-client.test.ts,client.test.ts, and cookie-related tests to verify path parameter handlingTest Coverage:
All existing tests continue to pass, ensuring no regression in functionality.