fix: Clear auto-login cookie on logout (#10528)

* add clear cookie session after logout

* fix jest test

Author: Cristhianzl

src/frontend/src/stores/authStore.ts

@@ -7,7 +7,7 @@ import {
   LANGFLOW_REFRESH_TOKEN,
 } from "@/constants/constants";
 import type { AuthStoreType } from "@/types/zustand/auth";
-import { getCookiesInstance } from "@/utils/cookie-manager";
+import { cookieManager, getCookiesInstance } from "@/utils/cookie-manager";
 
 const cookies = getCookiesInstance();
 const useAuthStore = create<AuthStoreType>((set, get) => ({
@@ -33,6 +33,8 @@ const useAuthStore = create<AuthStoreType>((set, get) => ({
     localStorage.removeItem(LANGFLOW_API_TOKEN);
     localStorage.removeItem(LANGFLOW_REFRESH_TOKEN);
 
+    cookieManager.clearAuthCookies();
+
     get().setIsAuthenticated(false);
     get().setIsAdmin(false);
 

src/frontend/src/utils/__tests__/cookie-manager.test.ts

@@ -289,7 +289,7 @@ describe("CookieManager", () => {
     it("should clear all auth-related cookies", () => {
       cookieManager.clearAuthCookies();
 
-      expect(mockCookiesInstance.remove).toHaveBeenCalledTimes(3);
+      expect(mockCookiesInstance.remove).toHaveBeenCalledTimes(4);
       expect(mockCookiesInstance.remove).toHaveBeenCalledWith(
         "access_token_lf",
         {
@@ -314,6 +314,11 @@ describe("CookieManager", () => {
           sameSite: "lax",
         },
       );
+      expect(mockCookiesInstance.remove).toHaveBeenCalledWith("auto_login_lf", {
+        path: "/",
+        secure: false,
+        sameSite: "lax",
+      });
     });
   });
 

src/frontend/src/utils/cookie-manager.ts

@@ -2,6 +2,7 @@ import { Cookies } from "react-cookie";
 import {
   LANGFLOW_ACCESS_TOKEN,
   LANGFLOW_API_TOKEN,
+  LANGFLOW_AUTO_LOGIN_OPTION,
   LANGFLOW_REFRESH_TOKEN,
 } from "@/constants/constants";
 
@@ -71,6 +72,7 @@ class CookieManager {
     this.remove(LANGFLOW_ACCESS_TOKEN);
     this.remove(LANGFLOW_API_TOKEN);
     this.remove(LANGFLOW_REFRESH_TOKEN);
+    this.remove(LANGFLOW_AUTO_LOGIN_OPTION);
   }
 }
 

src/frontend/tests/core/regression/general-bugs-remove-session-after-logout.spec.ts

@@ -0,0 +1,69 @@
+import { expect, test } from "../../fixtures";
+
+test(
+  "user must not be able to login after logout and refresh the page when auto_login is false",
+  { tag: ["@release", "@api"] },
+  async ({ page }) => {
+    await page.route("**/api/v1/auto_login", (route) => {
+      route.fulfill({
+        status: 500,
+        contentType: "application/json",
+        body: JSON.stringify({
+          detail: { auto_login: false },
+        }),
+      });
+    });
+
+    await page.addInitScript(() => {
+      window.process = window.process || {};
+
+      const newEnv = { ...window.process.env, LANGFLOW_AUTO_LOGIN: "false" };
+
+      Object.defineProperty(window.process, "env", {
+        value: newEnv,
+        writable: true,
+        configurable: true,
+      });
+
+      sessionStorage.setItem("testMockAutoLogin", "true");
+    });
+
+    await page.goto("/");
+
+    await page.waitForSelector("text=sign in to langflow", { timeout: 30000 });
+
+    await page.getByPlaceholder("Username").fill("langflow");
+    await page.getByPlaceholder("Password").fill("langflow");
+
+    await page.evaluate(() => {
+      sessionStorage.removeItem("testMockAutoLogin");
+    });
+
+    await page.getByRole("button", { name: "Sign In" }).click();
+
+    await page.waitForSelector('[data-testid="mainpage_title"]', {
+      timeout: 30000,
+    });
+
+    await page.getByTestId("user-profile-settings").click();
+
+    await page.evaluate(() => {
+      sessionStorage.setItem("testMockAutoLogin", "true");
+    });
+
+    await page.getByText("Logout", { exact: true }).click();
+
+    await page.waitForTimeout(1000);
+
+    await page.reload();
+
+    await page.waitForSelector("text=sign in to langflow", { timeout: 30000 });
+
+    const isLoggedIn = await page
+      .getByTestId("mainpage_title")
+      .isVisible()
+      .catch(() => false);
+
+    expect(isLoggedIn).toBeFalsy();
+  },
+);