andymick01/craft2prints
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix logout cookie name mismatch

Browse Source 
The logout API was deleting 'session' but the actual customer session
cookie is named 'customer_session' (from auth.ts SESSION_COOKIE).

This fix ensures the logout properly clears the customer session, so users
are actually logged out when the browser closes.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
This commit is contained in:
Andymick
2026-07-18 07:14:40 +01:00
co-authored by Claude Haiku 4.5
parent 345e4b9656
commit 0cafa62713
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/app/api/logout/route.ts
+5 -4
View File
@@ -5,14 +5,15 @@ export async function POST() {
const cookieStore = await cookies(); const cookieStore = await cookies();
// Clear both admin and customer sessions // Clear both admin and customer sessions
// Must delete with same options they were set with // Customer session cookie is named 'customer_session' (from auth.ts)
// Admin session cookie is named 'adminSession'
cookieStore.delete('customer_session');
cookieStore.delete('adminSession'); cookieStore.delete('adminSession');
cookieStore.delete('session');
// Also send response with Set-Cookie headers to ensure deletion // Also send response with Set-Cookie headers to ensure deletion
const response = NextResponse.json({ success: true }); const response = NextResponse.json({ success: true });
response.headers.set('Set-Cookie', 'adminSession=; Path=/; Max-Age=0; HttpOnly'); response.headers.set('Set-Cookie', 'customer_session=; Path=/; Max-Age=0; HttpOnly');
response.headers.append('Set-Cookie', 'session=; Path=/; Max-Age=0; HttpOnly'); response.headers.append('Set-Cookie', 'adminSession=; Path=/; Max-Age=0; HttpOnly');
return response; return response;
} }