From 2554a61b44e53f742f0aa13c610a22aa43e9c1d7 Mon Sep 17 00:00:00 2001
From: gitadmin <aiyimickey@sina.com>
Date: Mon, 29 Jun 2026 20:05:19 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20logout=20=E7=AB=AF=E7=82=B9=E6=B7=BB?=
 =?UTF-8?q?=E5=8A=A0=20domain=20=E5=8F=82=E6=95=B0=E6=B8=85=E9=99=A4?=
 =?UTF-8?q?=E8=B7=A8=E5=9F=9F=20cookie?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- logout 端点清除 cookie 时添加 domain 参数
- 修复 .tlyq.ai 域的 tlyq_session cookie 未正确清除的问题
---
 src/app/api/auth/logout/route.ts | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/app/api/auth/logout/route.ts b/src/app/api/auth/logout/route.ts
index b3cba4c..4fb0e76 100644
--- a/src/app/api/auth/logout/route.ts
+++ b/src/app/api/auth/logout/route.ts
@@ -6,9 +6,12 @@ import { writeAuditLog, getClientIP } from '@/lib/audit'
 export async function POST(request: Request) {
   const session = await getSession()
   const cookieStore = await cookies()
-  cookieStore.set('session_assets', '', { maxAge: 0, path: '/' })
-  cookieStore.set('tlyq_session', '', { maxAge: 0, path: '/' })
-  cookieStore.set('oidc_id_token', '', { maxAge: 0, path: '/' })
+  const domain = process.env.COOKIE_DOMAIN || ''
+
+  // 清除 cookie 时必须指定与设置时相同的 domain
+  cookieStore.set('session_assets', '', { maxAge: 0, path: '/', domain })
+  cookieStore.set('tlyq_session', '', { maxAge: 0, path: '/', domain })
+  cookieStore.set('oidc_id_token', '', { maxAge: 0, path: '/', domain })
 
   if (session) {
     writeAuditLog({