Cookie is lingering around after login and/or logout about authentication-oauth2 HOT 2 CLOSED

Ya the cookie is valid for as long as the JWT is right now. Currently unless you explicitly set up a CookieExtractor for feathers-authentication-jwt then the cookie won't be used server side for authentication. Only the JWT that was extracted from the cookie and shoved into local storage is used.

Your best bet is to explicitly clear the cookie yourself after a successful auth and sounds like you are already doing that.

The reason we can't do that automatically is because for regular form posts and/or server side rendered apps we actually need the cookie to authenticate the user (kind of like a session). It's definitely not ideal.

In the next major version Feathers Auth we're going to be defaulting to using the URL instead of cookies for redirects, SSR and OAuth. Cookies will then only be needed for regular form posts so shouldn't cause any more of these weird issues.

We'll leave this open for reference and close it out when that functionality comes in. 🍻

from authentication-oauth2.

If this is implemented, will we be able to disable it if needed, so that the cookie won't be cleared automatically?

In our scenario, there's a browser extension, which loads in 3d-party websites and sends requests to the same server that serves our website (React+FeathersJS client). the authentication token is sent automatically by the browser through cookie. Login is only implemented in the website and local-storage is not shared between the website and the extension.

from authentication-oauth2.