From 34f5dfa6f17a17bdae056d868ffef4e244053869 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sun, 11 Oct 2026 09:08:10 +0200 Subject: [PATCH] Heimdall attempt cookie: a deletion carries only the Path HttpOnly, Secure and SameSite on a deletion decide nothing (a cookie is matched on name and path); Stryker found those two booleans surviving. The deletion is pinned by path, expiry and the absence of Max-Age. Co-Authored-By: Claude Opus 5.5 --- .../Features/Heimdall/HeimdallAuthService.cs | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/src/Bifrost.Web/Features/Heimdall/HeimdallAuthService.cs b/src/Bifrost.Web/Features/Heimdall/HeimdallAuthService.cs index 1672c96..05e1ccf 100644 --- a/src/Bifrost.Web/Features/Heimdall/HeimdallAuthService.cs +++ b/src/Bifrost.Web/Features/Heimdall/HeimdallAuthService.cs @@ -420,14 +420,8 @@ public static class HeimdallAttemptCookie }; /// - /// The options a deletion carries: the attempt cookie's Path, which a cookie is matched on, and no Max-Age, - /// which would take precedence over the expiry Delete writes and leave the emptied cookie alive. + /// The options a deletion carries: only the attempt cookie's Path, which a cookie is matched on. It carries no + /// Max-Age, which would take precedence over the expiry Delete writes and leave the emptied cookie alive. /// - public static CookieOptions DeleteOptions() => new() - { - HttpOnly = true, - Secure = true, - SameSite = SameSiteMode.Lax, - Path = "/auth/heimdall" - }; + public static CookieOptions DeleteOptions() => new() { Path = "/auth/heimdall" }; }