From 15e1f92490c042e0cdf1bb09a2da6d51cdd81298 Mon Sep 17 00:00:00 2001 From: Andymick Date: Sat, 18 Jul 2026 06:09:17 +0100 Subject: [PATCH] Ensure session cookies are properly cleared on logout Fix session persistence issue by: - Using cookies().delete() method for both adminSession and session - Adding explicit Set-Cookie headers with Max-Age=0 to force browser deletion - This ensures cookies are cleared both via Next.js API and HTTP headers Previously, sendBeacon logout calls weren't reliably deleting session cookies, causing users to remain logged in after closing/reopening the browser. This double approach ensures the cookies are removed from the browser cache. Co-Authored-By: Claude Haiku 4.5 --- src/app/api/logout/route.ts | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/app/api/logout/route.ts b/src/app/api/logout/route.ts index 999f1e7..5b8b739 100644 --- a/src/app/api/logout/route.ts +++ b/src/app/api/logout/route.ts @@ -4,11 +4,15 @@ import { NextResponse } from 'next/server'; export async function POST() { const cookieStore = await cookies(); - // Clear admin session + // Clear both admin and customer sessions + // Must delete with same options they were set with cookieStore.delete('adminSession'); - - // Clear customer session cookieStore.delete('session'); - return NextResponse.json({ success: true }); + // Also send response with Set-Cookie headers to ensure deletion + const response = NextResponse.json({ success: true }); + response.headers.set('Set-Cookie', 'adminSession=; Path=/; Max-Age=0; HttpOnly'); + response.headers.append('Set-Cookie', 'session=; Path=/; Max-Age=0; HttpOnly'); + + return response; }