Search code examples
aspnetboilerplate

Why does the app-auth service logout function in the angular template null the cookie instead of delete it?

logout(reload?: boolean): void {
    abp.auth.clearToken();
    abp.utils.setCookieValue(
        AppConsts.authorization.encryptedAuthTokenName,
        undefined,
        undefined,
        abp.appPath
    );
    if (reload !== false) {
        location.href = AppConsts.appBaseUrl;
    }
}

Why is it using this code instead of the deleteCookie function?

https://github.com/aspnetboilerplate/aspnetboilerplate/blob/059db7626b3642114b7a2ba7d15b6a14304640dd/src/Abp.Web.Resources/Abp/Framework/scripts/abp.js#L796

Solution

  • No particular reason. It has been changed to deleteCookie in aspnetboilerplate/module-zero-core-template@6cd84d7.

    deleteCookie(AppConsts.authorization.encryptedAuthTokenName, abp.appPath) sets something like enc_auth_token=; expires=Fri, 23 Apr 2021 00:00:00 GMT; path=/, where Fri, 23 Apr 2021 00:00:00 GMT is 86400000 milliseconds (one day) ago.

    • This causes the cookie to be deleted immediately.
    • getCookieValue would return null.

    setCookieValue(AppConsts.authorization.encryptedAuthTokenName, undefined, undefined, abp.appPath) sets something like enc_auth_token=; path=/, which is a session cookie.

    • This causes the cookie to be deleted when the session ends.
    • Before the session ends, getCookieValue would return '' (as of ABP v6.3).