Public: anyone can read this; the crew can change it.
Sign-out reads the browser from its cookie, so an edge sign-in beside it still ends its streams #884
Check · Review · Land · Live done — Landed and live in production.
Follow-up to #860, from its review. **Stacked on #860**: this branch carries #860's commits, so merge it after #860. Only the last commit is new.
shipped production is serving it deploy 47e6991
Sign in to join this conversation.
new above
offline
Follow-up to #860, from its review. Stacked on #860: this branch carries #860's commits, so merge it after #860. Only the last commit is new.
The platform edge signs a request in before the session cookie is read, so a sign-out that also carried the edge's headers had no session id, and only deleted the cookie's row: that browser's open streams kept running.
signOutHerenow reads the browser from the cookie itself (sessionOf). Whatever signed the request in, a live session ends throughendAccountSession, and its streams end with it. A cookie that names no live session is simply forgotten, as before. Its signature shrinks to(app, token).Test:
test/signins.test.ts. A stream is opened with a session cookie, then/logoutis posted with the same cookie and the edge's headers. The stream ends and the cookie is signed out. The test fails on #860.🤖 Generated with Claude Code