diff --git a/Femto.Api/Sessions/HttpContextSessionExtensions.cs b/Femto.Api/Sessions/HttpContextSessionExtensions.cs index ec41df2..f8f93b9 100644 --- a/Femto.Api/Sessions/HttpContextSessionExtensions.cs +++ b/Femto.Api/Sessions/HttpContextSessionExtensions.cs @@ -62,7 +62,28 @@ internal static class HttpContextSessionExtensions public static void DeleteSession(this HttpContext httpContext) { - httpContext.Response.Cookies.Delete("session"); - httpContext.Response.Cookies.Delete("user"); + var cookieSettings = httpContext.RequestServices.GetService>(); + + var secure = cookieSettings?.Value.Secure ?? true; + var sameSite = secure ? SameSiteMode.None : SameSiteMode.Unspecified; + var domain = cookieSettings?.Value.Domain; + + httpContext.Response.Cookies.Delete("session", new CookieOptions + { + HttpOnly = true, + Domain = domain, + IsEssential = true, + Secure = secure, + SameSite = sameSite, + Expires = DateTimeOffset.UtcNow.AddDays(-1), + }); + httpContext.Response.Cookies.Delete("user", new CookieOptions + { + Domain = domain, + IsEssential = true, + Secure = secure, + SameSite = sameSite, + Expires = DateTimeOffset.UtcNow.AddDays(-1), + }); } }