AstroCookies.delete does not support __Host- and __Secure- prefixed cookies

[fshafiee]

Astro Info

Astro version is irrelevant as you’ll see in the bug description, but here it is:

Astro                    v3.6.5
Node                     v20.10.0
System                   macOS (arm64)
Package Manager          pnpm
Output                   server
Adapter                  @astrojs/node
Integrations             @astrojs/react
                         @astrojs/tailwind

If this issue only occurs in one browser, which browser is a problem?

No response

Describe the Bug

The AstroCookies.delete API does not work for cookies with __Host- and __Secure- prefixes.

From MDN web docs:

__Host-
If a cookie name has this prefix, it's accepted in a Set-Cookie header only if it's also marked with the Secure attribute, was sent from a secure origin, does not include a Domain attribute, and has the Path attribute set to /. This way, these cookies can be seen as "domain-locked".
__Secure-
If a cookie name has this prefix, it's accepted in a Set-Cookie header only if it's marked with the Secure attribute and was sent from a secure origin. This is weaker than the __Host- prefix.

The key takeaway is the Secure attribute requirement, which based on the main branch of the repo, is not recognized by the AstroCookies.delete method:

astro/packages/astro/src/core/cookies/cookies.ts

Line 20 in 0ddc327

type AstroCookieDeleteOptions = Pick<AstroCookieSetOptions, 'domain' | 'path'>;

As an example, this is how the Chrome treats Set-Cookie headers that violate these requirements:

What's the expected result?

The AstroCookies.delete method should recognize all standard cookie attributes, except for the maxAge and expires, since these are the only attributes that set a valid cookie apart from its expired version.

My current workaround is to use the AstroCookies.set method as follows:

Astro.cookies.set("cookie-name", "deleted", {
    expires: new Date(0),
    secure: true,
    path: "/",
    httpOnly: true, 
})

Link to Minimal Reproducible Example

https://stackblitz.com/edit/github-avarao?file=README.md

Participation

• I am willing to submit a pull request for this issue.

[lilnasy]

Thanks for opening this issue. This seems like an important limitation of the Cookies API, the delete method has only two options.

I think it makes sense to allow httpOnly and secure as well. Do you know if those two will be enough for __Host-?

[fshafiee]

Hey @lilnasy,

Adding those flags would work in this case. However, this seems to be highly browser-dependent. For example, Chrome will also take partition attribute into account when trying to match existing cookies (which isn’t recognized by Astro, yet). And I have seen mixed behavior in the past when it comes to httpOnly.

My suggestion is to exclude value, maxAge, and expires cookie attributes when it comes to delete cookie API. It’s been a good practice for me to make sure the cookie attributes always match to ensure compatibility across browsers and different implementations.

However, if you insist on keeping the API surface limited, then yes, httpOnly and secure attributes are the absolute minimums that needs to be added to the delete API.

[lilnasy]

@fshafiee Thanks, shifting from Pick to Exclude is what I was thinking too. Are you interested in implementing it?

[fshafiee]

Of course @lilnasy. I'll open a PR in next few days.

[ematipico]

I assigned the issue to you @fshafiee

Let us know if you need any help or you have questions