Skip to content

fix(cookies): clear host-only copies of overwritten chunks when domain is set - #309

Open
RaphaelFakhri wants to merge 1 commit into
supabase:mainfrom
RaphaelFakhri:fix/host-only-clear-overwritten-chunks
Open

RaphaelFakhri wants to merge 1 commit into
supabase:mainfrom
RaphaelFakhri:fix/host-only-clear-overwritten-chunks

Conversation

@RaphaelFakhri

Copy link
Copy Markdown

What kind of change does this PR introduce?

Bug fix.

What is the current behavior?

Fixes #308.

When cookieOptions.domain is set, the browser setItem and applyServerStorage emit a host-only clear only for chunks they remove. Chunks they overwrite keep the same names, so after a host-only to .parent.tld migration the old host-only cookies stay until sign-out. Browsers list the older cookie first, and cookie.parse keeps the first value for a name, so the client reads the old session and its refresh fails.

What is the new behavior?

When domain is set, the host-only clear also covers each chunk being written that already exists in the current cookies. The clears come before the sets, so cookie stores keyed by name only (Next.js ResponseCookies) still keep the domain-scoped set. Writes of new cookies and configurations without domain are unchanged.

Additional context

  • Updates the expectation of the existing setItem chunk-cleanup test, which now also clears the host-only storage-key.
  • Adds tests for the overwritten chunks in setItem and applyServerStorage, for new cookies (no host-only clear), and for a name-keyed store keeping the set.
  • In name-keyed server stores the host-only clear for a rewritten name is still overwritten by the set, as before. The browser document.cookie path and stores that emit one Set-Cookie per entry clear the stale copy.

@RaphaelFakhri
RaphaelFakhri requested review from a team as code owners October 24, 2026 17:17

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Stale host-only auth cookies survive a Domain migration and shadow the new session

1 participant