[Amronos]

Description

CookieSession.getLogoutUrl() called authenticate() to get the session ID. authenticate() rejects an expired access token, so once the access token expired, getLogoutUrl() threw Failed to extract session ID for logout URL: invalid_jwt. An app that signs a user out after a period of inactivity, which is when the access token is most likely to be expired, could not build the logout URL. The WorkOS session stayed active.

getLogoutUrl() now unseals the cookie and reads sid from the access token without verifying it. The cookie password already authenticates the sealed cookie, so only this server could have written the token inside it. authkit-nextjs reads the session ID from the cookie for signOut() in the same way.

The errors for a missing cookie (no_session_cookie_provided) and for a cookie that won't unseal or has no access token (invalid_session_cookie) stay the same.

• New specs cover an expired access token and a cookie sealed with a different password.
• The existing getLogoutUrl specs no longer mock jwtVerify, since it isn't called.

Documentation

Does this require changes to the WorkOS Docs? E.g. the API Reference or code snippets need updates.

[ ] No

If yes, link a related docs PR and add a docs maintainer as a reviewer. Their approval is required.

Written by Opus 5.5 (opus-5.5) through Sprocket.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge.

Summary

CookieSession.getLogoutUrl() now reads the session ID from the sealed cookie without rejecting an expired access token.

• Cookie sessions can still build logout URLs after access tokens expire.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A["getLogoutUrl"] --> B{"Cookie provided?"}
  B -->|No| C["Throw missing-cookie error"]
  B -->|Yes| D["Open cookie with server password"]
  D --> E{"Access token present?"}
  E -->|No| F["Throw invalid-cookie error"]
  E -->|Yes| G["Decode sid without checking token expiry"]
  G --> H["Build logout URL"]

Loading

_{Reviews (1) · Last reviewed commit: "fix(user-management): Build logout URLs ..." · Reviewed by Greptile}