Skip to content

fix: update transaction cookie deletion to clear all cookies on succe…#2464

Open
rajyan wants to merge 1 commit intoauth0:mainfrom
rajyan:fix/issue-1917-infinite-stacking-cookies
Open

fix: update transaction cookie deletion to clear all cookies on succe…#2464
rajyan wants to merge 1 commit intoauth0:mainfrom
rajyan:fix/issue-1917-infinite-stacking-cookies

Conversation

@rajyan
Copy link
Copy Markdown

@rajyan rajyan commented Dec 14, 2025

  • All new/changed/fixed functionality is covered by tests (or N/A)
  • I have added documentation for all new/changed functionality (or N/A)

📋 Changes

This PR fixes the transaction cookie accumulation issue by calling deleteAll in handleCallback upon successful authentication.

Problem:
In v4, transaction cookies (__txn_*) accumulate over time as users navigate the app while unauthenticated. This eventually causes 431 errors due to request header size limits.

Solution:

  • Changed handleCallback to call transactionStore.deleteAll() instead of transactionStore.delete(state) after successful authentication
  • This ensures all accumulated transaction cookies are cleaned up when a user successfully logs in
  • Complements the existing deleteAll call in handleLogout

Changed files:

  • src/server/auth-client.ts: Replace delete(state) with deleteAll() in handleCallback
  • src/server/redundant-txn-cookie-deletion.test.ts: Update test to verify all transaction cookies are deleted on success

📎 References

🎯 Testing

Unit tests:

  • Updated redundant-txn-cookie-deletion.test.ts to verify that all transaction cookies are deleted after successful callback
  • All existing tests pass

Manual testing (verified locally):

  1. Started the app and navigated around while unauthenticated (created multiple __txn_* cookies)
  2. Logged in successfully
  3. Verified all __txn_* cookies were cleared from the browser

@rajyan rajyan requested a review from a team as a code owner December 14, 2025 07:06
@rajyan rajyan mentioned this pull request Dec 14, 2025
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

v4: Infinitely stacking cookies

1 participant