Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix signOut for custom cookie domains #116

Merged
merged 1 commit into from
Oct 21, 2024

Conversation

KNWR
Copy link
Contributor

@KNWR KNWR commented Oct 19, 2024

The signOut method in auth.ts does not delete cookies set with a custom domain. To reproduce, I had an application with WORKOS_COOKIE_DOMAIN set (I had it set to .myrootdomain.extension for local), and signOut did end the user session on the WorkOS dashboard, but didn't delete the session cookie, so the user still appeared logged in. This PR lets signOut delete custom domain cookies by checking if a custom domain has been set for the cookie. If so, it adds the custom domain to the keys that cookies().delete() matches against, now finding the cookie and deleting it. I've tested this locally by using this fork of the package in my app.

This lets authkit-nextjs work for applications that use a subdomain per customer (ex. customer1.myenterpriseco.com).

In case this takes a while to merge and other people run into this issue, I'm using a custom sign out method as a workaround:

import { WorkOS } from '@workos-inc/node';

export async function signOutCustom() {
  const workos = new WorkOS(
    process.env.WORKOS_API_KEY!,
    {clientId: process.env.WORKOS_CLIENT_ID!,
  });
  const session = workos.userManagement.loadSealedSession({
    sessionData: cookies().get('wos-session')?.value!,
    cookiePassword: process.env.WORKOS_COOKIE_PASSWORD!,
  });
  const logoutUrl = await session.getLogoutUrl();
  cookies().delete({name: 'wos-session', domain: process.env.WORKOS_COOKIE_DOMAIN!});
  redirect(logoutUrl);
}

…stom domain. This enables custom domain cookies to be deleted by checking if a custom domain has been set for the cookie. If so, it adds the custom domain to the keys that Nextjs' ResponseCookie's delete method matches against, now finding the cookie and deleting it.
Copy link
Contributor

@PaulAsjes PaulAsjes left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is great, thanks!

@PaulAsjes PaulAsjes merged commit 7fa52f5 into workos:main Oct 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants