diff --git a/src/services/management/__tests__/management-auth.test.ts b/src/services/management/__tests__/management-auth.test.ts index ec16328..f5b5282 100644 --- a/src/services/management/__tests__/management-auth.test.ts +++ b/src/services/management/__tests__/management-auth.test.ts @@ -35,7 +35,6 @@ describe("Manager session cookie", () => { expect.any(String), expect.objectContaining({ secure: false, path: "/" }), ); - expect(cookieSet).toHaveBeenCalledWith("nextchair_manager_session", "", { path: "/manager", maxAge: 0 }); }); it("marks the cookie Secure for an HTTPS deployment", async () => { diff --git a/src/services/management/management-auth.ts b/src/services/management/management-auth.ts index 67a5ec6..c3960e7 100644 --- a/src/services/management/management-auth.ts +++ b/src/services/management/management-auth.ts @@ -25,11 +25,7 @@ export function authenticateManager(email: string, password: string) { export async function createManagerSession() { const config = getManagerConfig(); const value = `${config.adminEmail.trim().toLowerCase()}.${Date.now()}`; - const store = await cookies(); - // Remove sessions issued by older builds with Path=/manager. Browsers can - // retain both cookies, and the stale one may be selected first on /manager. - store.set(COOKIE_NAME, "", { path: "/manager", maxAge: 0 }); - store.set(COOKIE_NAME, `${value}.${signature(value, config.authSecret)}`, { + (await cookies()).set(COOKIE_NAME, `${value}.${signature(value, config.authSecret)}`, { httpOnly: true, sameSite: "strict", secure: isSecureDeployment(), @@ -41,9 +37,7 @@ export async function createManagerSession() { } export async function clearManagerSession() { - const store = await cookies(); - store.delete(COOKIE_NAME); - store.set(COOKIE_NAME, "", { path: "/manager", maxAge: 0 }); + (await cookies()).delete(COOKIE_NAME); } export async function isManagerAuthenticated() {