Cookie未被HTTP标头删除

Question

My project is using an external authentication provider that sets a cookie if a user is logged in. To log out, I have to delete that cookie. As far as I can tell, the Set-Cookie header is correct, but the cookie isn't changed. This is the header:

{{cookie_name}}: ""
domain: "{{cookie_domain}}"
expires: "1970-01-01T00:00:00.000Z"
path: "/"

This is the cookie before, and after, going to the logout view:

Name: {{cookie_name}}
Content: (random string to verify login)
Host: {{cookie_domain}}
Path: /
Send for: Encrypted connections only
Expires: At end of session

Everything is HTTPS. Does anyone know of reasons that a Set-Cookie header might not work?

Answer 1

Did you try setting all the attributes in the Set-Cookie header when you try to delete the cookie. All attributes that are set in the exisiting cookie should be set when you try to delete. From the example you gave above, it seems you are not setting the secure flag when you try to delete the cookie.

Answer 2

It was really an issue with the framework I use (Django). When I manually set the domain in the set_cookie function, it prefixed a period which meant that it didn't match the existing cookie. When I didn't enter a domain, it used the default and didn't prefix anything, and it worked.