Skip to content

Commit 033517e

Browse files
authored
Fix: Ensure clear_auth_cookie uses the correct secure and samesite settings (#1959)
* Update cookie.py - Ensure clear_auth_cookie uses correct secure and samesite settings Ensure clear_auth_cookie uses correct secure and samesite settings clear_auth_cookie was not explicitly specifying the secure and samesite attributes when deleting cookies. This could cause logout issues if CHAINLIT_COOKIE_SAMESITE was set to a custom value. Now, clear_auth_cookie applies the same secure and samesite settings as set_auth_cookie to ensure consistent behavior. * Update cookie.py fix format
1 parent cbdaafb commit 033517e

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

backend/chainlit/auth/cookie.py

+6-2
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,9 @@ def set_auth_cookie(request: Request, response: Response, token: str):
149149

150150
# Delete remaining prior cookies/cookie chunks
151151
for k in existing_cookies:
152-
response.delete_cookie(key=k, path="/")
152+
response.delete_cookie(
153+
key=k, path="/", secure=_cookie_secure, samesite=_cookie_samesite
154+
)
153155

154156

155157
def clear_auth_cookie(request: Request, response: Response):
@@ -162,7 +164,9 @@ def clear_auth_cookie(request: Request, response: Response):
162164
}
163165

164166
for k in existing_cookies:
165-
response.delete_cookie(key=k, path="/")
167+
response.delete_cookie(
168+
key=k, path="/", secure=_cookie_secure, samesite=_cookie_samesite
169+
)
166170

167171

168172
def set_oauth_state_cookie(response: Response, token: str):

0 commit comments

Comments
 (0)