Correct logout with an expiring token instead of deleting it

Author: jess2304

WS/api/views.py

@@ -102,12 +102,14 @@ class LogoutView(APIView):
     def post(self, request):
         logger.info(f"[Logout] Cookies reçus pour suppression : {request.COOKIES}")
         response = Response({"detail": "Déconnecté."}, status=status.HTTP_200_OK)
-        deletion_keys = ["path", "domain"]
-        cookie_params_delete = {
-            k: v for k, v in COOKIE_PARAMS.items() if k in deletion_keys
-        }
-        response.delete_cookie("access_token", **cookie_params_delete)
-        response.delete_cookie("refresh_token", **cookie_params_delete)
+
+        for cookie in ["access_token", "refresh_token"]:
+            response.set_cookie(
+                key=cookie,
+                value="",
+                max_age=0,
+                **COOKIE_PARAMS,
+            )
         return response
 
 

WS/next_shape_ws/settings.py

@@ -226,7 +226,7 @@ def get_cookie_settings():
             "path": "/",
         }
     else:
-        return {"httponly": True, "secure": True, "samesite": "None", "path": "/"}
+        return {"httponly": True, "secure": False, "samesite": "Lax", "path": "/"}
 
 
 COOKIE_PARAMS = get_cookie_settings()