From 60769e9ed370843a7149c27cc3753fb9014aaeae Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 30 Jan 2025 22:26:00 +0100
Subject: [PATCH] improve cookie handling for cloud apps

---
 backend/windmill-api/src/users.rs             |  1 -
 .../(logged)/user/(user)/login/+page.svelte   | 22 ++++++++++++++++++-
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/backend/windmill-api/src/users.rs b/backend/windmill-api/src/users.rs
index 97c7116795..b603259664 100644
--- a/backend/windmill-api/src/users.rs
+++ b/backend/windmill-api/src/users.rs
@@ -47,7 +47,6 @@ use windmill_common::users::COOKIE_NAME;
 use windmill_common::users::{truncate_token, username_to_permissioned_as};
 use windmill_common::utils::paginate;
 use windmill_common::worker::CLOUD_HOSTED;
-use windmill_common::BASE_URL;
 use windmill_common::{
     auth::{get_folders_for_user, get_groups_for_user},
     db::UserDB,
diff --git a/frontend/src/routes/(root)/(logged)/user/(user)/login/+page.svelte b/frontend/src/routes/(root)/(logged)/user/(user)/login/+page.svelte
index fbb18311a8..794c22e48e 100644
--- a/frontend/src/routes/(root)/(logged)/user/(user)/login/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/(user)/login/+page.svelte
@@ -12,6 +12,7 @@
 	import { clearStores } from '$lib/storeUtils'
 	import { setLicense } from '$lib/enterpriseUtils'
 	import Login from '$lib/components/Login.svelte'
+	import { onMount } from 'svelte'
 
 	const email = $page.url.searchParams.get('email') ?? ''
 	const password = $page.url.searchParams.get('password') ?? ''
@@ -21,6 +22,26 @@
 	let showPassword = false
 	let firstTime = false
 
+	function clearWindmillCloudCookies() {
+		const domain = window.location.hostname
+		// Check if the domain ends with ".windmill.dev" but is NOT "app.windmill.dev"
+		if (
+			domain.endsWith('.windmill.dev') &&
+			domain !== 'app.windmill.dev' &&
+			domain !== 'internal.windmill.dev'
+		) {
+			// Remove the "token" cookie for the current domain and its parent domain
+			document.cookie = `token=; domain=.windmill.dev; path=/; expires=Thu, 01 Jan 1970 00:00:00 UTC; Secure; SameSite=None`
+			document.cookie = `token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 UTC; Secure; SameSite=None`
+
+			console.log('Token cookie removed for windmill cloud instance.')
+		}
+	}
+
+	onMount(() => {
+		clearWindmillCloudCookies()
+	})
+
 	async function redirectUser() {
 		if (rd?.startsWith('http')) {
 			window.location.href = rd
@@ -80,7 +101,6 @@
 	}
 
 	try {
-		
 		setLicense()
 		redirectIfNecessary()
 		checkFirstTimeSetup()