fix(clerk-js): unset domain cookies

packages/clerk-js/src/core/auth/cookies/__tests__/session.test.ts

@@ -3,18 +3,21 @@ import { addYears } from '@clerk/shared/date';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
 import { inCrossOriginIframe } from '../../../../utils';
+import { getCookieDomain } from '../../getCookieDomain';
 import { getSecureAttribute } from '../../getSecureAttribute';
 import { createSessionCookie } from '../session';
 
 vi.mock('@clerk/shared/cookie');
 vi.mock('@clerk/shared/date');
 vi.mock('../../../../utils');
+vi.mock('../../getCookieDomain');
 vi.mock('../../getSecureAttribute');
 
 describe('createSessionCookie', () => {
   const mockCookieSuffix = 'test-suffix';
   const mockToken = 'test-token';
   const mockExpires = new Date('2024-12-31');
+  const mockDomain = 'example.com';
   const mockSet = vi.fn();
   const mockRemove = vi.fn();
   const mockGet = vi.fn();
@@ -24,6 +27,7 @@ describe('createSessionCookie', () => {
     mockGet.mockReset();
     (addYears as ReturnType<typeof vi.fn>).mockReturnValue(mockExpires);
     (inCrossOriginIframe as ReturnType<typeof vi.fn>).mockReturnValue(false);
+    (getCookieDomain as ReturnType<typeof vi.fn>).mockReturnValue(mockDomain);
     (getSecureAttribute as ReturnType<typeof vi.fn>).mockReturnValue(true);
     (createCookieHandler as ReturnType<typeof vi.fn>).mockImplementation(() => ({
       set: mockSet,
@@ -43,12 +47,16 @@ describe('createSessionCookie', () => {
     const cookieHandler = createSessionCookie(mockCookieSuffix);
     cookieHandler.set(mockToken);
 
+    // Should call remove first to clean up subdomain-scoped cookies (2 calls)
+    // Then set with domain attribute (2 calls)
+    expect(mockRemove).toHaveBeenCalledTimes(2);
     expect(mockSet).toHaveBeenCalledTimes(2);
     expect(mockSet).toHaveBeenCalledWith(mockToken, {
+      domain: mockDomain,
       expires: mockExpires,
+      partitioned: false,
       sameSite: 'Lax',
       secure: true,
-      partitioned: false,
     });
   });
 
@@ -58,42 +66,64 @@ describe('createSessionCookie', () => {
     cookieHandler.set(mockToken);
 
     expect(mockSet).toHaveBeenCalledWith(mockToken, {
+      domain: mockDomain,
       expires: mockExpires,
+      partitioned: false,
       sameSite: 'None',
       secure: true,
-      partitioned: false,
     });
   });
 
   it('should remove both cookies when remove is called', () => {
     const cookieHandler = createSessionCookie(mockCookieSuffix);
     cookieHandler.remove();
 
-    expect(mockRemove).toHaveBeenCalledTimes(2);
+    // Should remove with domain (2 calls) and without domain for backward compat (2 calls)
+    expect(mockRemove).toHaveBeenCalledTimes(4);
   });
 
   it('should remove cookies with the same attributes as set', () => {
     const cookieHandler = createSessionCookie(mockCookieSuffix);
     cookieHandler.set(mockToken);
     cookieHandler.remove();
 
-    const expectedAttributes = {
+    const expectedAttributesWithDomain = {
+      domain: mockDomain,
+      partitioned: false,
       sameSite: 'Lax',
       secure: true,
+    };
+
+    const expectedAttributesWithoutDomain = {
       partitioned: false,
+      sameSite: 'Lax',
+      secure: true,
     };
 
     expect(mockSet).toHaveBeenCalledWith(mockToken, {
+      domain: mockDomain,
       expires: mockExpires,
+      partitioned: false,
       sameSite: 'Lax',
       secure: true,
-      partitioned: false,
     });
 
-    expect(mockRemove).toHaveBeenCalledWith(expectedAttributes);
-    expect(mockRemove).toHaveBeenCalledTimes(2);
-    expect(mockRemove).toHaveBeenNthCalledWith(1, expectedAttributes);
-    expect(mockRemove).toHaveBeenNthCalledWith(2, expectedAttributes);
+    // set() calls remove twice to clean up subdomain cookies
+    // remove() calls remove 4 times (2 with domain, 2 without)
+    // Total: 6 remove calls
+    expect(mockRemove).toHaveBeenCalledTimes(6);
+
+    // During set(): removes without params (2 calls)
+    expect(mockRemove).toHaveBeenNthCalledWith(1);
+    expect(mockRemove).toHaveBeenNthCalledWith(2);
+
+    // During remove(): removes with domain (2 calls)
+    expect(mockRemove).toHaveBeenNthCalledWith(3, expectedAttributesWithDomain);
+    expect(mockRemove).toHaveBeenNthCalledWith(4, expectedAttributesWithDomain);
+
+    // During remove(): removes without domain for backward compat (2 calls)
+    expect(mockRemove).toHaveBeenNthCalledWith(5, expectedAttributesWithoutDomain);
+    expect(mockRemove).toHaveBeenNthCalledWith(6, expectedAttributesWithoutDomain);
   });
 
   it('should get cookie value from suffixed cookie first, then fallback to non-suffixed', () => {

packages/clerk-js/src/core/auth/cookies/session.ts

@@ -3,6 +3,7 @@ import { addYears } from '@clerk/shared/date';
 import { getSuffixedCookieName } from '@clerk/shared/keys';
 
 import { inCrossOriginIframe } from '../../../utils';
+import { getCookieDomain } from '../getCookieDomain';
 import { getSecureAttribute } from '../getSecureAttribute';
 
 const SESSION_COOKIE_NAME = '__session';
@@ -31,22 +32,34 @@ export const createSessionCookie = (cookieSuffix: string): SessionCookieHandler
 
   const remove = () => {
     const attributes = getCookieAttributes();
+    const domain = getCookieDomain();
+
+    // Remove cookies with domain attribute
+    sessionCookie.remove({ ...attributes, domain });
+    suffixedSessionCookie.remove({ ...attributes, domain });
+
+    // Also remove cookies without domain attribute for backward compatibility
     sessionCookie.remove(attributes);
     suffixedSessionCookie.remove(attributes);
   };
 
   const set = (token: string) => {
     const expires = addYears(Date.now(), 1);
     const { sameSite, secure, partitioned } = getCookieAttributes();
+    const domain = getCookieDomain();
+
+    // Remove any existing cookies without a domain specified to ensure subdomain-scoped cookies are cleaned up
+    sessionCookie.remove();
+    suffixedSessionCookie.remove();
 
     // If setting Partitioned to true, remove the existing session cookies.
     // This is to avoid conflicts with the same cookie name without Partitioned attribute.
     if (partitioned) {
       remove();
     }
 
-    sessionCookie.set(token, { expires, sameSite, secure, partitioned });
-    suffixedSessionCookie.set(token, { expires, sameSite, secure, partitioned });
+    sessionCookie.set(token, { domain, expires, partitioned, sameSite, secure });
+    suffixedSessionCookie.set(token, { domain, expires, partitioned, sameSite, secure });
   };
 
   const get = () => suffixedSessionCookie.get() || sessionCookie.get();