Skip to content

Remove the legacy auth cookie

This operation deletes the SAIFAUTH cookie so a consuming application can clear the legacy credential cookie, typically at logout.

Field Value
Operation ID OP-05
Trigger A consumer calls ClearCookie(), inferred to be at logout*
Inputs the ambient HttpContext from IHttpContextAccessor
Outputs An expiring Set-Cookie: SAIFAUTH=; expires=<past>; path=/ header. Returns void.
Primary components LegacyAuthCookieService.ClearCookie
Entry point src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/LegacyAuthCookieService.cs

Steps

  1. Read the current HttpContext from the injected accessor.
  2. On failure: outside an active request, this is null and the next step throws NullReferenceException (BR-10)
  3. Call Response.Cookies.Delete("SAIFAUTH") with default CookieOptions (BR-01, BR-14)
  4. The delete header carries no HttpOnly flag, which is the framework default and has low impact because the deleted value is empty*.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start(["Trigger: ClearCookie called"]) --> S1["Read HttpContext<br>from accessor"]
    S1 --> D1{HttpContext null?}
    D1 -->|Yes| ErrNull([NullReferenceException])
    D1 -->|No| S2["Response.Cookies.Delete<br>SAIFAUTH, default options"]
    S2 --> EndOk([Expiring Set-Cookie header written])

Failure and edge-case behavior

  • Calling ClearCookie outside an active HTTP request throws NullReferenceException before any header is written (BR-10)
  • The default delete path / matches the issued path (BR-14), so the browser removes the cookie; however, clearing is client-side only — a copied cookie remains decryptable since there is no server-side revocation*.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

  • src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/LegacyAuthCookieService.cs