session id cookies are not cleared

[crossit]

Hey everyone,

we're using @adonisjs/session with the following config

driver: 'cookie',
cookieName: 'adonis-session',
  clearWithBrowser: true,
  age: '2h',
  cookie: {
    path: '/',
    httpOnly: true,
    sameSite: false,
  },

and accessing a seperate view

Route.on('/shop').render('shop')

If I remove or rename the adonis-session Cookie, a new crypt-named cookie appears. Same behavior when I'm entering /shop after 2 hours.
So we (and normal visitors) keep getting new crypt-named cookies and at some point the header fields size of the server exceeds. Same with clearWithBrowser: false

Any idea what the issue could be?

Thanks!

[thetutlage]

If I remove or rename the adonis-session Cookie, a new crypt-named cookie appears

Can you share how you remove the adonis-session cookie?

[crossit]

I just remove it from the dev console, reload the page, new adonis-session cookie appears plus a new crypt-named cookie.
same behavior when I'm reloading the page after 2h.

[thetutlage]

Yup. Coz the adonis-session holds the session id and that cryptic cookie is an hash of that session id and holds the session value inside it. So when you manually delete the adonis-session, the backend creates a new session id + new hash holding value appears.

[crossit]

Thanks for your answer! Okay so its expected behavior. But what about the normal visitors who access the site from time to time and keep getting new cryptic cookies?

[thetutlage]

Shouldn't happen with normal visitors. Since, both the adonis-session and the cryptic cookie expires together.