From 585b70459796d6f567b3a39609e63750421a2ec3 Mon Sep 17 00:00:00 2001
From: Classic298 <27028174+Classic298@users.noreply.github.com>
Date: Fri, 24 Jul 2026 07:59:43 +0200
Subject: [PATCH] fix: clear token cookie on 401 auth redirect to stop login
 flash loop (#26751)

Since v0.10.0 a global fetch interceptor redirects to /auth and clears
localStorage.token whenever an authenticated backend request returns 401.
The OAuth callback cookie ("token", set with httponly=False so the
frontend can read it) is left behind. The auth page's oauthCallbackHandler
then immediately signs the user back in from that cookie and navigates to
"/", where the next 401 triggers the redirect again. The result is an
endless /auth and / ping-pong that renders as uncontrollable screen
flashing, and as a PWA stuck on a flashing splash screen when SvelteKit's
update check turns each navigation into a full page reload. Affected
users could only recover by clearing cookies, which matches the reports.

Clear the token cookie together with localStorage when redirecting, so
/auth stays on the login form and the user can sign in again normally.

Fixes #26731
---
 src/routes/+layout.svelte | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/routes/+layout.svelte b/src/routes/+layout.svelte
index 1a5c080d7c..d1628124ad 100644
--- a/src/routes/+layout.svelte
+++ b/src/routes/+layout.svelte
@@ -849,6 +849,8 @@
 		}
 		user.set(null);
 		localStorage.removeItem('token');
+		// Clear the OAuth token cookie so /auth doesn't auto-login and redirect-loop
+		document.cookie = 'token=; Max-Age=0; path=/';
 		userSignOut().catch((error) => {
 			console.error('Error signing out expired session:', error);
 		});