Unable to delete session cookie

[hermitdemschoenenleb]

I’m writing a web application that communicates with Couchbase Sync Gateway using PouchDB synchronization. For authentication I use CORS requests with the javascript fetch API to POST to the _session endpoint with username and password (and credentials: "include"), which works fine. I encountered a problem though when the password of the user is changed. Doing so obviously invalidates the session cookie. Unfortunately, this makes it impossible to obtain a new session: deleting the session cookie in my application does not work because sync gateway runs on another URL. Subsequent POST requests to _session return 401, even if the new credentials are included in the request body. I hoped that a DELETE request to the _session endpoint would help me, but this also results in 401 all the time (using credentials: "include").

Is there any way that I’m missing to get rid of the session cookie in order to obtain a new one?

[bbrks]

Cross-posting response from GitHub Issue.

@bbrks@github.com - https://github.com/couchbase/sync_gateway/issues/4552#issuecomment-613466149

Are you able to send the request for a new session without the old cookie by using XMLHttpRequest.withCredentials=false?

If not, this does look like a bit of a gap if the client is unable to clear its own cookies.

As a workaround, you can use basic auth along with sending the old cookie in a DELETE session request.

15:07 $ curl -i -c sgcookie -b sgcookie -X DELETE http://demo:password3@localhost:4984/db1/_session
HTTP/1.1 200 OK
Server: /2.8 branch/ commit/ EE
Set-Cookie: SyncGatewaySession=; Expires=Tue, 14 Apr 2020 14:07:31 GMT
Date: Tue, 14 Apr 2020 14:07:31 GMT
Content-Length: 0