Correct logOut using Passport. ClearCookie doesn't delete cookies.

I’m using PassportJS and this code for logout:

  .get("/logout", async (req, res) => {
    await req.logout();
    req.session = null;
    await res.clearCookie(process.env.PROJECT_TITLE.toLowerCase());
    await res.clearCookie(`${process.env.PROJECT_TITLE.toLowerCase()}.sig`);
    return res.redirect("/");
  });

It just changes the cookies but don’t delete them. Why?

It does delete them if I use just this code:

  .get("/logout", async (req, res) => {
    await res.clearCookie(process.env.PROJECT_TITLE.toLowerCase());
    await res.clearCookie(`${process.env.PROJECT_TITLE.toLowerCase()}.sig`);
    return res.redirect("/");
  });

Where am I wrong?

[dougwilson]

This is an example remix that will do the req.logout() and clear the cookie in your logout route: https://glitch.com/edit/#!/tiny-chinchilla

[dougwilson]

Hi @frederikhors

your remix is just: await req.logout(); >> to >> //await req.logout();, right?

correct, that was the only change in my remix.

I think await req.logout(); should work and after that AWAIT it should does NOTHING!

The issue I’m seeing is that req.logout is altering the session, which is why the session is getting updated in your logout request.

I think await req.logout(); should work and after that AWAIT it should does NOTHING!

I’m not very familiar with passport. Maybe can you explain exact what req.logout is doing apart from altering req.session? We may be able to determine this by understanding the specifics of what req.logout does.

But what I found is that the cookie is getting set on your logout because of the following:

(1) req.logout alters the req.session object, so a need to set the cookie is noted by this module (2) the code calls clearcookie, which has nothing to do with this module and this module has no idea your code did that. clearing a cookie is just setting a cookie with an expiration date in the past (3) the response ends and this module sees that (a) the req.session object was changed, thus it knows it needs to set the new value and (b) req.session.save() hasn’t been called, so it will automatically save the changes for you

So it seems like you have one of two options:

(a) don’t touch the req.session if you don’t want a new value to be saved in the cookie (this is why I commented out req.logout()

OR

(b) call req.session.save() to explicitly save the changes to the session that req.logout() made and then do the clear cookie calls.

I hope that helps 👍