Session cookie not cleared if logout route is not at the root level #8
Description
With SignedCookieBackend, session().clear() doesn't clear cookies if it is called on a route that isn't at the server root (e.g. /path/logout). This problem doesn't happen if Path=/ is added to the Set-Cookie header. I've confirmed this with both Firefox 45 and Chrome 57. I haven't tested this with the RedisBackend.
A minimal demonstration and a workaround can be found in this gist.
The dependencies that I used are
- iron 0.5.1
- mount 0.3.0
- router 0.5.1
- iron-sessionstorage 0.6.6
Edit: Looks like the issue is caused by this line. It seems like since Path is set when the cookie is created, cookie.clear does not remove the cookie.