diff --git a/src/app/logout/actions.ts b/src/app/logout/actions.ts index baf4192..491a412 100644 --- a/src/app/logout/actions.ts +++ b/src/app/logout/actions.ts @@ -6,6 +6,7 @@ export async function clearAuthCookies() { const cookieStore = await cookies(); // Delete all next-auth v5 cookie variants + // Must specify path and secure options to match how they were set const cookieNames = [ 'authjs.session-token', 'authjs.csrf-token', @@ -13,10 +14,36 @@ export async function clearAuthCookies() { '__Secure-authjs.session-token', '__Secure-authjs.csrf-token', '__Secure-authjs.callback-url', + // next-auth v4 fallback names + 'next-auth.session-token', + 'next-auth.csrf-token', + 'next-auth.callback-url', + '__Secure-next-auth.session-token', + '__Secure-next-auth.csrf-token', + '__Secure-next-auth.callback-url', + // Host-prefixed variants (used when behind a proxy) + '__Host-authjs.csrf-token', + '__Host-next-auth.csrf-token', ]; for (const name of cookieNames) { - cookieStore.delete(name); + // Delete with explicit options to ensure cookie is actually removed + cookieStore.delete({ + name, + path: '/', + }); + } + + // Also try getting all cookies and deleting any auth-related ones + const allCookies = cookieStore.getAll(); + for (const cookie of allCookies) { + if ( + cookie.name.includes('authjs') || + cookie.name.includes('next-auth') || + cookie.name.includes('session-token') + ) { + cookieStore.delete({ name: cookie.name, path: '/' }); + } } return { success: true }; diff --git a/src/app/logout/page.tsx b/src/app/logout/page.tsx index ae44794..abe3254 100644 --- a/src/app/logout/page.tsx +++ b/src/app/logout/page.tsx @@ -25,8 +25,14 @@ export default function LogoutPage() { localStorage.removeItem('refreshToken'); localStorage.removeItem('user'); + // Delete httpOnly cookies via server action FIRST + // This ensures the session cookie is gone before signOut triggers session checks + await clearAuthCookies(); + + // Client-side signOut to clear NextAuth client state await signOut({ redirect: false }); - // Delete httpOnly cookies via server action (Next.js cookies() API) + + // Delete cookies again after signOut in case signOut recreated any await clearAuthCookies(); // Redirect to login immediately diff --git a/src/components/layout/Footer.tsx b/src/components/layout/Footer.tsx index 0d5364d..9d67405 100644 --- a/src/components/layout/Footer.tsx +++ b/src/components/layout/Footer.tsx @@ -98,9 +98,10 @@ export function Footer() {
Copyright © 2025 Your Agency Name. All rights reserved.
- + Privacy Policy