From fda18abc89ba6e1eb67c2ce3c032d83f307706b1 Mon Sep 17 00:00:00 2001 From: Zeni Kim Date: Sat, 12 Sep 2026 22:17:24 -0500 Subject: [PATCH] Deletes the user's cookie if it expires or something fails. --- controllers/app-auth.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/controllers/app-auth.go b/controllers/app-auth.go index b79902e..32ed3f3 100644 --- a/controllers/app-auth.go +++ b/controllers/app-auth.go @@ -125,15 +125,21 @@ func AppSignout(c *core.Context) *core.Response { // get cookie usercookie, err := c.GetCookie() if err != nil { + // the cookie could not be read/decrypted, still make sure it is removed from the client + core.ClearCookie(c.Response.HttpResponseWriter) return c.Response.Redirect("/applogin") } token = usercookie.Token if token == "" { + // no token present, still clear any (possibly present) cookie on the client + core.ClearCookie(c.Response.HttpResponseWriter) return c.Response.Redirect("/applogin") } payload, err := c.GetJWT().DecodeToken(token) if err != nil { + // the token is invalid, clear the cookie on the client + core.ClearCookie(c.Response.HttpResponseWriter) return c.Response.Redirect("/applogin") } userAgent := c.GetUserAgent() @@ -141,9 +147,15 @@ func AppSignout(c *core.Context) *core.Response { err = c.GetCache().Delete(hashedCacheKey) if err != nil { + // failed to invalidate the cached token, still clear the cookie on the client + core.ClearCookie(c.Response.HttpResponseWriter) return c.Response.Redirect("/applogin") } + // successful signout: the token is removed from the cache, also clear + // the cookie on the client before the final redirect + core.ClearCookie(c.Response.HttpResponseWriter) + return c.Response.Redirect("/applogin") }