Search code examples
javascriptcookiessession-cookiesidentityserver3httpcookie

Remove the Identity Server Cookie in Browser using Javascript

I'm using Identity Server for Single Sign On, I would like to delete the Identity Server Cookie manually using JavaScript from an appropriate Client application.

I referred lots of tutorials but no one is given any solution for my requirement.

I deployed my Identity Server in the https://localhost:2025 and I deployed the Client UI in http://localhost:3000

I need to Remove the following Cookie which is displayed under https://localhost:2025 in the following image.

enter image description here

I tried lots of Stack overflow questions, out of those I listed few for your reference.

Clearing all cookies with JavaScript

Solution

  • If the cookie was issued with the HttpOnly flag from the server you will not be able to access or modify its value from the client:

    An HttpOnly cookie cannot be accessed by client-side APIs, such as JavaScript. This restriction eliminates the threat of cookie theft via cross-site scripting (XSS). However, the cookie remains vulnerable to cross-site tracing (XST) and cross-site request forgery (XSRF) attacks. A cookie is given this characteristic by adding the HttpOnly flag to the cookie.

    From the provided screenshot it seems that you can only access the idsvr.session cookie from javascript because it is not marked as HTTP.

    As a workaround you could make an AJAX call to some server side endpoint that will clear all cookies as it will have access to them.