From 0cafa6271352b5fcc03ae436b747b6346d9ab835 Mon Sep 17 00:00:00 2001 From: Andymick Date: Sat, 18 Jul 2026 07:14:40 +0100 Subject: [PATCH] Fix logout cookie name mismatch The logout API was deleting 'session' but the actual customer session cookie is named 'customer_session' (from auth.ts SESSION_COOKIE). This fix ensures the logout properly clears the customer session, so users are actually logged out when the browser closes. Co-Authored-By: Claude Haiku 4.5 --- src/app/api/logout/route.ts | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/app/api/logout/route.ts b/src/app/api/logout/route.ts index 5b8b739..26ff14e 100644 --- a/src/app/api/logout/route.ts +++ b/src/app/api/logout/route.ts @@ -5,14 +5,15 @@ export async function POST() { const cookieStore = await cookies(); // Clear both admin and customer sessions - // Must delete with same options they were set with + // Customer session cookie is named 'customer_session' (from auth.ts) + // Admin session cookie is named 'adminSession' + cookieStore.delete('customer_session'); cookieStore.delete('adminSession'); - cookieStore.delete('session'); // Also send response with Set-Cookie headers to ensure deletion const response = NextResponse.json({ success: true }); - response.headers.set('Set-Cookie', 'adminSession=; Path=/; Max-Age=0; HttpOnly'); - response.headers.append('Set-Cookie', 'session=; Path=/; Max-Age=0; HttpOnly'); + response.headers.set('Set-Cookie', 'customer_session=; Path=/; Max-Age=0; HttpOnly'); + response.headers.append('Set-Cookie', 'adminSession=; Path=/; Max-Age=0; HttpOnly'); return response; }