Controlling cookie lifecycle in Ktor 0.9.0 servlet

Viewed 1156

I'm having problems deleting a cookie set by a Ktor 0.9.0 server side application. Maybe I don't know how to do it the right way, or there's an omission in the Ktor framework.

Cookie creation and deletion is not the problem per se, but in order to delete a cookie I've to use the same path that is stored with the cookie on the client browser. Ktor let me control the path with cookie creation. Here's my configuration:

install(Sessions) {
    cookie<MySession>(sessionMarker) {
        cookie.duration = cookieDuration
        cookie.path = "/myWebapp"
        transform(SessionTransportTransformerMessageAuthentication(sessionKey))
    }
}

On the login page /myWebapp/page/login, I create the cookie that is then sent to the client and it travels back and forth for the rest of the requests sent to the web application:

call.sessions.set(MySession([some data class arguments]))

The cookie shows the path /myWebapp when inspected on the client. The default would be /myWebapp/page because that's the path of the login page, but the path is taken from the cookie configuration shown above. All is well until now.

Eventually the user wants to log out via a POST request to the login page:

call.sessions.clear<MySession>()

The problem here is that I've not found a way of controlling the cookie's path. Because the login page /myWebapp/page/login is sending the expired cookie back to the client for another path (its own /myWebapp/page), the original cookie is not deleted (/myWebapp/page != /myWebapp).

How can I control the cookie's path in Ktor 0.9.0 when trying to delete it?

I know how to work around it: by creating the cookie with the same path from where I'll delete it. But that's not what I want (there're other paths within the web applications like /myWebapp/others were the cookie should be used). Having the ability to control the cookie's path during creation makes no sense then.

1 Answers
Related