---
title: Remove the legacy auth cookie
summary: Deletes the SAIFAUTH cookie from the response using framework-default delete options.
status: draft
owner: Framework
last_reviewed: 2026-10-02
library: SAIF.NetCore.LegacyAuth
reference_type: package
operation_id: OP-05
trigger: A consumer calls ClearCookie(), inferred to be at logout.
---

# Remove the legacy auth cookie

This operation deletes the `SAIFAUTH` cookie so a consuming application can clear the legacy credential cookie, typically at logout.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-05 |
| **Trigger** | A consumer calls `ClearCookie()`, inferred to be at logout* |
| **Inputs** | the ambient `HttpContext` from `IHttpContextAccessor` |
| **Outputs** | An expiring `Set-Cookie: SAIFAUTH=; expires=<past>; path=/` header. Returns `void`. |
| **Primary components** | `LegacyAuthCookieService.ClearCookie` |
| **Entry point** | `src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/LegacyAuthCookieService.cs` |

## Steps

1. Read the current `HttpContext` from the injected accessor.
   - On failure: outside an active request, this is `null` and the next step throws `NullReferenceException` ([BR-10](../business-rules.md#br-10-active-http-request-required-for-cookie-operations))
2. Call `Response.Cookies.Delete("SAIFAUTH")` with default `CookieOptions` ([BR-01](../business-rules.md#br-01-fixed-cookie-name-saifauth), [BR-14](../business-rules.md#br-14-default-cookie-delete-options-on-clear))
   - The delete header carries no `HttpOnly` flag, which is the framework default and has low impact because the deleted value is empty*.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
    Start(["Trigger: ClearCookie called"]) --> S1["Read HttpContext<br>from accessor"]
    S1 --> D1{HttpContext null?}
    D1 -->|Yes| ErrNull([NullReferenceException])
    D1 -->|No| S2["Response.Cookies.Delete<br>SAIFAUTH, default options"]
    S2 --> EndOk([Expiring Set-Cookie header written])
```

## Failure and edge-case behavior
- Calling `ClearCookie` outside an active HTTP request throws `NullReferenceException` before any header is written ([BR-10](../business-rules.md#br-10-active-http-request-required-for-cookie-operations))
- The default delete path `/` matches the issued path ([BR-14](../business-rules.md#br-14-default-cookie-delete-options-on-clear)), so the browser removes the cookie; however, clearing is client-side only — a copied cookie remains decryptable since there is no server-side revocation*.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts.

## Sources
- `src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/LegacyAuthCookieService.cs`