From 9d13d72c71e03eda37a136f48fb46ee0a3593ec8 Mon Sep 17 00:00:00 2001 From: Steven Nguyen Date: Tue, 23 May 2023 10:40:31 -0700 Subject: [PATCH] Update the Update Account Status API to clear the cookie After a user updates their status, their session no longer works however, the cookie may still exist in their browser, preventing other API calls from completing successfully. --- app/controllers/api/account.php | 6 ++++++ tests/e2e/Services/Account/AccountCustomClientTest.php | 2 ++ 2 files changed, 8 insertions(+) diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php index 7c46e634c1..e211c123ee 100644 --- a/app/controllers/api/account.php +++ b/app/controllers/api/account.php @@ -1789,6 +1789,12 @@ App::patch('/v1/account/status') $response->addHeader('X-Fallback-Cookies', \json_encode([])); } + $protocol = $request->getProtocol(); + $response + ->addCookie(Auth::$cookieName . '_legacy', '', \time() - 3600, '/', Config::getParam('cookieDomain'), ('https' == $protocol), true, null) + ->addCookie(Auth::$cookieName, '', \time() - 3600, '/', Config::getParam('cookieDomain'), ('https' == $protocol), true, Config::getParam('cookieSamesite')) + ; + $response->dynamic($user, Response::MODEL_ACCOUNT); }); diff --git a/tests/e2e/Services/Account/AccountCustomClientTest.php b/tests/e2e/Services/Account/AccountCustomClientTest.php index ea24d06bdb..585c07ba59 100644 --- a/tests/e2e/Services/Account/AccountCustomClientTest.php +++ b/tests/e2e/Services/Account/AccountCustomClientTest.php @@ -221,6 +221,8 @@ class AccountCustomClientTest extends Scope ]); $this->assertEquals($response['headers']['status-code'], 200); + $this->assertStringContainsString('a_session_' . $this->getProject()['$id'] . '=deleted', $response['headers']['set-cookie']); + $this->assertEquals('[]', $response['headers']['x-fallback-cookies']); $response = $this->client->call(Client::METHOD_GET, '/account', array_merge([ 'origin' => 'http://localhost',