remove domain attribute to set OAuth cookies as host-only

Signed-off-by: Jessica He <jhe@redhat.com>

plugins/auth-node/report.api.md

@@ -178,7 +178,7 @@ export type CookieConfigurer = (ctx: {
   callbackUrl: string;
   appOrigin: string;
 }) => {
-  domain: string;
+  domain?: string;
   path: string;
   secure: boolean;
   sameSite?: 'none' | 'lax' | 'strict';

plugins/auth-node/src/oauth/OAuthCookieManager.ts

@@ -47,7 +47,7 @@ const defaultCookieConfigurer: CookieConfigurer = ({
     ? pathname.slice(0, -'/handler/frame'.length)
     : `${pathname}/${providerId}`;
 
-  return { domain, path, secure, sameSite };
+  return { path, secure, sameSite };
 };
 
 /** @internal */
@@ -184,6 +184,15 @@ export class OAuthCookieManager {
       }
     }
 
+    // If using the default cookieConfigurer, delete old cookie with domain set to the callbackUrl's domain (legacy behavior)
+    if (this.cookieConfigurer === defaultCookieConfigurer) {
+      const { hostname: domain } = new URL(this.options.callbackUrl);
+      output = output.cookie(name, '', {
+        ...this.getRemoveCookieOptions(),
+        domain: `.${domain}`,
+      });
+    }
+
     return output.cookie(name, val, options);
   }
 

plugins/auth-node/src/types.ts

@@ -411,7 +411,7 @@ export type CookieConfigurer = (ctx: {
   /** The origin URL of the app */
   appOrigin: string;
 }) => {
-  domain: string;
+  domain?: string;
   path: string;
   secure: boolean;
   sameSite?: 'none' | 'lax' | 'strict';