javascript - node express, how to clear cookie after log out - Stack Overflow

admin管理员组

文章数量:1202195

Basically i'm doing redirect from a.example to www.example and i expect to be able to delete cookies on www.example (because cookie is created with .example as the cookie domain), but following code doesn't work.

I know that this question seems like duplicate question, i tried everything from similar question but it doesn't work. See after the code what i already tried.

Using express 3.0.3 and node 0.10.32.

express session middleware

...
var cookiedata = { 
    domain              : '.example',
    originalMaxAge      : null,
    httpOnly            : false
};

app.use(express.session({
        store  : ..., 
        secret : ..., 
        key    : 'express.sid', 
        cookie : cookiedata 
}));
...

logout function

function logout(req, res){
    ...

    req.session.destroy(function(){
        req.session = null;

        res.clearCookie('express.sid', { path: '/' });
        res.redirect('');

    });
}

What i already tried from similar question

1. 
   

So i put path : '/' in express session middleware such as:

app.use(express.session({ ..., path : '/' });

No success.

2. !topic/express-js/PmgGMNOzhgM
   Instead res.clearCookie i used: res.cookie('express.sid', '', {expires: new Date(1), path: '/' });

No success.

Basically i'm doing redirect from a.example.com to www.example.com and i expect to be able to delete cookies on www.example.com (because cookie is created with .example.com as the cookie domain), but following code doesn't work.

I know that this question seems like duplicate question, i tried everything from similar question but it doesn't work. See after the code what i already tried.

Using express 3.0.3 and node 0.10.32.

express session middleware

...
var cookiedata = { 
    domain              : '.example.com',
    originalMaxAge      : null,
    httpOnly            : false
};

app.use(express.session({
        store  : ..., 
        secret : ..., 
        key    : 'express.sid', 
        cookie : cookiedata 
}));
...

logout function

function logout(req, res){
    ...

    req.session.destroy(function(){
        req.session = null;

        res.clearCookie('express.sid', { path: '/' });
        res.redirect('https://www.example.com');

    });
}

What i already tried from similar question

1. https://github.com/strongloop/express/issues/691
   

So i put path : '/' in express session middleware such as:

app.use(express.session({ ..., path : '/' });

No success.

2. https://groups.google.com/forum/#!topic/express-js/PmgGMNOzhgM
   Instead res.clearCookie i used: res.cookie('express.sid', '', {expires: new Date(1), path: '/' });

No success.

• javascript
• node.js
• cookies
• express
• express-session

Share Improve this question Follow edited Aug 20, 2015 at 10:07 Srle asked Aug 20, 2015 at 9:36 SrleSrle 10.5k99 gold badges3535 silver badges6767 bronze badges 1

• 1 Did you find a solution to this? No accepted answer here. – Samuel Méndez Commented Jul 7, 2017 at 9:24

Add a comment  | 

3 Answers 3

Sorted by: Reset to default 11

This is response.clearCookie of Express.JS (file response.js at line 749).

var opts = merge({ expires: new Date(1), path: '/' }, options);
return this.cookie(name, '', opts);

If you set a breakpoint at this line you will see expires is reported at an invalid date. So instead of using response.clearCookie, just make it expire immediately like this one.

response.cookie("express.sid", "", { expires: new Date() });

This is working for me with cookie-parser module:

router.get('/logout', function(req, res){
    cookie = req.cookies;
    for (var prop in cookie) {
        if (!cookie.hasOwnProperty(prop)) {
            continue;
        }    
        res.cookie(prop, '', {expires: new Date(0)});
    }
    res.redirect('/');
});

What worked for me was adding path and domain in res.clearCookie

res.clearCookie(<cookie-name>, {path: '/', domain: <domain-on-which-cookie-is-set>}

Also, make sure to include credentials on the frontend, otherwise no cookie will be sent with the request. If no cookie goes to the server, it has nothing to clear!

fetch('url.com', {credentials: "include"}

本文标签： javascriptnode expresshow to clear cookie after log outStack Overflow