feat: implement robust logout API route to clear all authentication cookies

src/app/logout/page.tsx

@@ -33,15 +33,27 @@ export default function LogoutPage() {
       localStorage.removeItem('refreshToken');
       localStorage.removeItem('user');
 
-      // Call NextAuth signOut — canonical way to clear session cookie
-      // (uses the exact cookie name/attributes from cookies config in auth.ts)
+      // Call NextAuth signOut first (clears session via NextAuth's own logic)
       try {
         await signOut({ redirect: false });
       } catch {
         // Continue even if signOut fails
       }
 
-      // Belt-and-suspenders: server action to nuke any remaining auth cookies
+      // Hit our explicit logout route handler — returns Set-Cookie headers
+      // that nuke ALL auth cookies. Route handlers are more reliable than
+      // server actions for cookie deletion in production.
+      try {
+        await fetch('/api/logout', {
+          method: 'POST',
+          credentials: 'include',
+          cache: 'no-store',
+        });
+      } catch {
+        // Continue
+      }
+
+      // Server action fallback
       try {
         await clearAuthCookies();
       } catch {