fix: match cookie parameters when deleting cookies in logout endpoint

[iliakrupin]

This fixes a critical logout bug where users would appear logged out but remain authenticated in the background. The issue occurred because the logout endpoint was deleting cookies without matching the security parameters (httponly, samesite, secure, domain) used when creating them.

Browsers require exact parameter matching to delete cookies, so the authentication cookies remained active despite logout confirmation.

Changes:

• Updated logout endpoint to use the same cookie parameters as login
• Ensures proper cookie deletion in all environments (HTTP/HTTPS)
• Fixes security issue in shared computer scenarios

Fixes #8641

Summary by CodeRabbit

• Bug Fixes
  • Improved security of authentication cookie deletion by enforcing explicit secure attributes (httponly, samesite, secure) during logout. Cookies are now properly configured with security settings sourced from authentication configuration.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

The logout endpoint now deletes cookies using parameters sourced from auth_settings, ensuring consistent secure attributes (HttpOnly, Secure, SameSite, domain) between cookie creation during login and cookie deletion during logout.

Changes

Cohort / File(s)	Summary
Cookie deletion parameter matching src/backend/base/langflow/api/v1/login.py	Modified logout function to retrieve auth_settings via get_settings_service() and parameterize cookie deletions for refresh_token_lf, access_token_lf, and apikey_tkn_lflw with explicit HttpOnly, SameSite, Secure, and domain attributes from auth configuration.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Verify get_settings_service() is properly imported and available in the module
• Confirm REFRESH_* and ACCESS_* configuration settings contain the expected cookie attributes (HttpOnly, Secure, SameSite values)
• Validate that all three cookie deletions correctly apply the appropriate settings
• Check that the cookie parameter structure matches the browser's expectations for deletion (exact matching of original cookie attributes)

Pre-merge checks and finishing touches

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (3 warnings, 2 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.
Test Quality And Coverage	⚠️ Warning	Logout endpoint cookie deletion fix lacks test coverage validating cookies are deleted with correct parameters (httponly, samesite, secure, domain).	Add pytest tests validating that refresh_token_lf, access_token_lf, and apikey_tkn_lflw cookies are deleted with matching parameters and that token refresh fails post-logout.
Test File Naming And Structure	⚠️ Warning	PR modifies logout endpoint to fix cookie deletion bug but includes no test files to verify the fix.	Add test_login.py with pytest tests verifying cookies are deleted with correct HttpOnly, Secure, SameSite parameters and refresh returns 401 after logout.
Test Coverage For New Implementations	❓ Inconclusive	Cannot verify test coverage due to inaccessible repository structure in sandbox environment.	Access the repository to confirm logout endpoint tests exist that validate cookie deletion with correct parameters (httponly, secure, samesite, domain) matching login's cookie settings.
Excessive Mock Usage Warning	❓ Inconclusive	PR modifies only the logout endpoint implementation without including any test file changes, making mock usage assessment impossible.	Clarify whether test files were modified in this PR by providing the complete list of changed files to assess mock usage patterns.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: fixing cookie parameter matching during cookie deletion in the logout endpoint.
Linked Issues check	✅ Passed	The code changes address the root cause identified in #8641 by ensuring logout uses matching cookie parameters (httponly, samesite, secure, domain) when deleting cookies.
Out of Scope Changes check	✅ Passed	All changes are directly related to fixing the cookie parameter mismatch issue in the logout endpoint, with no out-of-scope modifications detected.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[iliakrupin]

Hey @Cristhianzl,

Original PR #8643 lost its commits after an accidental Sync Fork overwrote the branch. This PR contains the same fix - just recreated.

Thanks for your previous approval!

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 403b939 and 16d3514.

📒 Files selected for processing (1)

• src/backend/base/langflow/api/v1/login.py (1 hunks)

🧰 Additional context used

📓 Path-based instructions (1)

{src/backend/**/*.py,tests/**/*.py,Makefile}

📄 CodeRabbit inference engine (.cursor/rules/backend_development.mdc)

{src/backend/**/*.py,tests/**/*.py,Makefile}: Run make format_backend to format Python code before linting or committing changes
Run make lint to perform linting checks on backend Python code

Files:

• src/backend/base/langflow/api/v1/login.py

🧬 Code graph analysis (1)

src/backend/base/langflow/api/v1/login.py (1)

src/backend/base/langflow/services/deps.py (1)

• get_settings_service (122-135)

🪛 GitHub Actions: Ruff Style Check

src/backend/base/langflow/api/v1/login.py

[error] 164-164: Ruff check failed. W293 Blank line contains whitespace. Command: uv run --only-dev ruff check --output-format=github .

🪛 GitHub Check: Ruff Style Check (3.13)

src/backend/base/langflow/api/v1/login.py

[failure] 164-164: Ruff (W293)
src/backend/base/langflow/api/v1/login.py:164:1: W293 Blank line contains whitespace

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (17)

• GitHub Check: Run Frontend Tests / Determine Test Suites and Shard Distribution
• GitHub Check: Test Docker Images / Test docker images
• GitHub Check: Lint Backend / Run Mypy (3.12)
• GitHub Check: Lint Backend / Run Mypy (3.10)
• GitHub Check: Lint Backend / Run Mypy (3.11)
• GitHub Check: Run Backend Tests / Unit Tests - Python 3.10 - Group 5
• GitHub Check: Run Backend Tests / Unit Tests - Python 3.10 - Group 2
• GitHub Check: Lint Backend / Run Mypy (3.13)
• GitHub Check: Run Backend Tests / Unit Tests - Python 3.10 - Group 4
• GitHub Check: Run Backend Tests / Unit Tests - Python 3.10 - Group 3
• GitHub Check: Run Backend Tests / Unit Tests - Python 3.10 - Group 1
• GitHub Check: Run Backend Tests / LFX Tests - Python 3.10
• GitHub Check: Run Backend Tests / Integration Tests - Python 3.10
• GitHub Check: Test Starter Templates
• GitHub Check: Optimize new Python code in this PR
• GitHub Check: Update Component Index
• GitHub Check: Update Starter Projects

🔇 Additional comments (1)

src/backend/base/langflow/api/v1/login.py (1)

165-185: Excellent fix for the logout cookie deletion bug!

The cookie deletion parameters now correctly match those used during login, ensuring browsers can properly remove the cookies. Each cookie is deleted with the exact httponly, samesite, secure, and domain attributes used when the cookie was set:

• refresh_token_lf: uses REFRESH_* settings (matches lines 45-49)
• access_token_lf: uses ACCESS_* settings (matches lines 54-58)
• apikey_tkn_lflw: uses ACCESS_* settings (matches lines 63-67)

This addresses the security issue where users remained authenticated after logout in shared-computer scenarios.

[Cristhianzl]

lgtm