feat(auth): kill Authelia session cookie on logout

src/main.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
+	"net/url"
 	"os"
 	"os/signal"
 	"path/filepath"
@@ -132,15 +133,14 @@ func main() {
 			HttpOnly: true,
 			SameSite: http.SameSiteLaxMode,
 		})
-		// Clear NextWks session and redirect to workspace
+		// Clear both NextWks and Authelia session cookies
 		http.SetCookie(w, &http.Cookie{
-			Name:     "nextwks_session",
+			Name: "nextwks_session", Value: "", Path: "/", Domain: cfg.OIDC.Domain,
-			Value:    "",
+			MaxAge: -1, HttpOnly: true, SameSite: http.SameSiteLaxMode,
-			Path:     "/",
+		})
-			Domain:   cfg.OIDC.Domain,
+		http.SetCookie(w, &http.Cookie{
-			MaxAge:   -1,
+			Name: "authelia_session", Value: "", Path: "/", Domain: domainFromURL(cfg.OIDC.IssuerURL),
-			HttpOnly: true,
+			MaxAge: -1, HttpOnly: true, SameSite: http.SameSiteLaxMode,
-			SameSite: http.SameSiteLaxMode,
 		})
 		http.Redirect(w, r, "/", http.StatusFound)
 	})
@@ -240,3 +240,11 @@ func corsMiddleware(next http.Handler) http.Handler {
 		next.ServeHTTP(w, r)
 	})
 }
+
+func domainFromURL(rawURL string) string {
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return ""
+	}
+	return u.Hostname()
+}