From f3ef5105d3efab75bce885249db3d8f93a49ca0b Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@rubenfiszel.com>
Date: Wed, 29 Jan 2025 17:38:06 +0100
Subject: [PATCH] clear cookies for cloud windmill.dev subdomains

---
 backend/windmill-api/src/users.rs | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/backend/windmill-api/src/users.rs b/backend/windmill-api/src/users.rs
index fdb40d97c5..da8fa3094a 100644
--- a/backend/windmill-api/src/users.rs
+++ b/backend/windmill-api/src/users.rs
@@ -47,6 +47,7 @@ use windmill_common::users::COOKIE_NAME;
 use windmill_common::users::{truncate_token, username_to_permissioned_as};
 use windmill_common::utils::paginate;
 use windmill_common::worker::CLOUD_HOSTED;
+use windmill_common::BASE_URL;
 use windmill_common::{
     auth::{get_folders_for_user, get_groups_for_user},
     db::UserDB,
@@ -1718,13 +1719,30 @@ pub async fn create_session_token<'c>(
     if COOKIE_DOMAIN.is_some() {
         cookie.set_domain(COOKIE_DOMAIN.clone().unwrap());
     }
+
     let mut expire: OffsetDateTime = time::OffsetDateTime::now_utc();
     expire += time::Duration::days(3);
     cookie.set_expires(expire);
     cookies.add(cookie);
+    clear_windmill_dev(&cookies).await;
     Ok(token)
 }
 
+async fn clear_windmill_dev(cookies: &Cookies) {
+    if !*CLOUD_HOSTED && BASE_URL.read().await.ends_with(".windmill.dev") {
+        //clear .windmill.dev cookie
+        let mut cookie = Cookie::new(COOKIE_NAME, "".to_string());
+        cookie.set_secure(IS_SECURE.read().await.clone());
+        cookie.set_same_site(Some(tower_cookies::cookie::SameSite::Lax));
+        cookie.set_http_only(true);
+        cookie.set_path(COOKIE_PATH);
+        cookie.set_domain(".windmill.dev");
+        // set expire in min timestamp
+        cookie.set_expires(time::OffsetDateTime::UNIX_EPOCH);
+        cookies.add(cookie);
+    }
+}
+
 async fn create_token(
     Extension(db): Extension<DB>,
     authed: ApiAuthed,