{"record":{"id":"59f20916eced98f8","repo":"plandex-ai/plandex","slug":"error-clearing-auth-cookie","errorCode":null,"errorMessage":"Error clearing auth cookie: ","messagePattern":"Error clearing auth cookie: ","errorType":"http","errorClass":"http","httpStatus":500,"severity":"warning","filePath":"app/server/handlers/sessions.go","lineNumber":272,"sourceCode":"\n\tauth := Authenticate(w, r, false)\n\tif auth == nil {\n\t\treturn\n\t}\n\n\t_, err := db.Conn.Exec(\"UPDATE auth_tokens SET deleted_at = NOW() WHERE token_hash = $1\", auth.AuthToken.TokenHash)\n\n\tif err != nil {\n\t\tlog.Printf(\"Error deleting auth token: %v\\n\", err)\n\t\thttp.Error(w, \"Error deleting auth token: \"+err.Error(), http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\terr = ClearAuthCookieIfBrowser(w, r)\n\n\tif err != nil {\n\t\tlog.Printf(\"Error clearing auth cookie: %v\\n\", err)\n\t\thttp.Error(w, \"Error clearing auth cookie: \"+err.Error(), http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\terr = ClearAccountFromCookies(w, r, auth.User.Id)\n\n\tif err != nil {\n\t\tlog.Printf(\"Error clearing account from cookies: %v\\n\", err)\n\t\thttp.Error(w, \"Error clearing account from cookies: \"+err.Error(), http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tlog.Println(\"Successfully signed out\")\n}\n\nfunc GetOrgUserConfigHandler(w http.ResponseWriter, r *http.Request) {\n\tlog.Println(\"Received request for GetOrgUserConfigHandler\")\n\n\tauth := Authenticate(w, r, true)","sourceCodeStart":254,"sourceCodeEnd":290,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/server/handlers/sessions.go#L254-L290","documentation":"SignOutHandler reports HTTP 500 at app/server/handlers/sessions.go:268-273 when ClearAuthCookieIfBrowser returns an error while trying to expire/remove the authentication cookie on the response. This is typically the http.SetCookie/write-header path failing, e.g. because response headers were already written.","triggerScenarios":"Calling sign-out when response headers have already been flushed (anything wrote to w earlier in the request chain), or the cookie-clearing helper fails to construct/write the expired Set-Cookie header.","commonSituations":"Middleware already wrote a response body or headers before the handler ran, a middleware double-writes the header, or http: superfluous WriteHeader warnings accompany this error after header writes were attempted twice.","solutions":["Ensure no middleware or earlier code writes to the ResponseWriter before ClearAuthCookieIfBrowser runs","Inspect ClearAuthCookieIfBrowser for header-write errors (e.g. 'http: superfluous response.WriteHeader')","Set the expired cookie only via w.Header().Add(\"Set-Cookie\", ...) before any body write","Confirm cookie domain/path on the clearing call exactly matches the cookie originally set, or browsers will not remove it"],"exampleFix":"// before\nerr = ClearAuthCookieIfBrowser(w, r)\nif err != nil {\n\thttp.Error(w, \"Error clearing auth cookie: \"+err.Error(), http.StatusInternalServerError)\n\treturn\n}\n// after\nerr = ClearAuthCookieIfBrowser(w, r)\nif err != nil {\n\t// cookie write failure should not block sign-out; token already invalidated server-side\n\tlog.Printf(\"Error clearing auth cookie: %v\\n\", err)\n}","handlingStrategy":"fallback","validationCode":"// server-side pre-check: header not yet written before clearing cookies\n_, wrote := w.(interface{ Written() bool })\nif wrote && w.(http.Flusher) == nil {\n\t// only safe if nothing has been flushed; otherwise skip and log\n\t_ = w\n}","typeGuard":"func canSetCookies(w http.ResponseWriter) bool {\n\t// http.ResponseWriter allows header writes until WriteHeader/Flush is called\n\t_, isFlusher := w.(http.Flusher)\n\treturn !isFlusher // conservative: skip cookie writes once flushing is possible/started\n}","tryCatchPattern":"err := ClearAuthCookieIfBrowser(w, r)\nif err != nil {\n\t// fall back to manually expiring the cookie\n\thttp.SetCookie(w, &http.Cookie{Name: \"auth_token\", Value: \"\", Path: \"/\", MaxAge: -1})\n}","preventionTips":["Never write to the ResponseWriter before cookie operations complete","Match Name/Path/Domain exactly when expiring cookies","Treat cookie-clear failures as non-fatal once the server token is invalidated"],"tags":["go","http","cookies","session"],"backgroundTag":"cookie-clear-failed","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}