fix: Enhance logout cookie deletion to cover more NextAuth cookie variants and adjust the logout sequence, and disable prefetching for footer links.

src/app/logout/actions.ts

@@ -6,6 +6,7 @@ export async function clearAuthCookies() {
   const cookieStore = await cookies();
 
   // Delete all next-auth v5 cookie variants
+  // Must specify path and secure options to match how they were set
   const cookieNames = [
     'authjs.session-token',
     'authjs.csrf-token',
@@ -13,10 +14,36 @@ export async function clearAuthCookies() {
     '__Secure-authjs.session-token',
     '__Secure-authjs.csrf-token',
     '__Secure-authjs.callback-url',
+    // next-auth v4 fallback names
+    'next-auth.session-token',
+    'next-auth.csrf-token',
+    'next-auth.callback-url',
+    '__Secure-next-auth.session-token',
+    '__Secure-next-auth.csrf-token',
+    '__Secure-next-auth.callback-url',
+    // Host-prefixed variants (used when behind a proxy)
+    '__Host-authjs.csrf-token',
+    '__Host-next-auth.csrf-token',
   ];
 
   for (const name of cookieNames) {
-    cookieStore.delete(name);
+    // Delete with explicit options to ensure cookie is actually removed
+    cookieStore.delete({
+      name,
+      path: '/',
+    });
+  }
+
+  // Also try getting all cookies and deleting any auth-related ones
+  const allCookies = cookieStore.getAll();
+  for (const cookie of allCookies) {
+    if (
+      cookie.name.includes('authjs') ||
+      cookie.name.includes('next-auth') ||
+      cookie.name.includes('session-token')
+    ) {
+      cookieStore.delete({ name: cookie.name, path: '/' });
+    }
   }
 
   return { success: true };

src/app/logout/page.tsx

@@ -25,8 +25,14 @@ export default function LogoutPage() {
       localStorage.removeItem('refreshToken');
       localStorage.removeItem('user');
 
+      // Delete httpOnly cookies via server action FIRST
+      // This ensures the session cookie is gone before signOut triggers session checks
+      await clearAuthCookies();
+
+      // Client-side signOut to clear NextAuth client state
       await signOut({ redirect: false });
-      // Delete httpOnly cookies via server action (Next.js cookies() API)
+
+      // Delete cookies again after signOut in case signOut recreated any
       await clearAuthCookies();
 
       // Redirect to login immediately