Repository navigation
[v3-4-test] Keep the token cookie set by a route in JWTRefreshMiddleware (#75217) - #75454
Merged
Merged
Conversation
…are (#75217) JWTRefreshMiddleware appends its own _token Set-Cookie after the response headers. When the route itself sets _token, the browser applies the middleware cookie last, so it overrides the route: - A login route, e.g. an auth manager callback mounted under /auth, sets a fresh token while the request still carries an expired or invalid one. The middleware appends a deletion and the user is logged out right after logging in. - /api/v2/auth/logout deletes the cookie, but if refresh_user returned a refreshed user for that request the middleware appends a newly minted, unrevoked token and the user stays logged in. Skip the middleware token cookie when the response already sets _token. Stale root-path cookies are still cleared. (cherry picked from commit 99eff46) Co-authored-by: Mathieu Monet <60776491+stegololz@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
vincbeck
approved these changes
Oct 23, 2026
Contributor
Author
|
Hi maintainer, this PR was merged without a milestone set.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
JWTRefreshMiddleware appends its own _token Set-Cookie after the
response headers. When the route itself sets _token, the browser
applies the middleware cookie last, so it overrides the route:
sets a fresh token while the request still carries an expired or
invalid one. The middleware appends a deletion and the user is
logged out right after logging in.
a refreshed user for that request the middleware appends a newly
minted, unrevoked token and the user stays logged in.
Skip the middleware token cookie when the response already sets
_token. Stale root-path cookies are still cleared.
(cherry picked from commit 99eff46)
Co-authored-by: Mathieu Monet 60776491+stegololz@users.noreply.github.com
Co-authored-by: Claude Opus 5.5 noreply@anthropic.com