plandex-ai/plandex · warning · http

Error clearing auth cookie:

Error message

Error clearing auth cookie: 

What it means

SignOutHandler reports HTTP 500 at app/server/handlers/sessions.go:268-273 when ClearAuthCookieIfBrowser returns an error while trying to expire/remove the authentication cookie on the response. This is typically the http.SetCookie/write-header path failing, e.g. because response headers were already written.

Source

Thrown at app/server/handlers/sessions.go:272

	auth := Authenticate(w, r, false)
	if auth == nil {
		return
	}

	_, err := db.Conn.Exec("UPDATE auth_tokens SET deleted_at = NOW() WHERE token_hash = $1", auth.AuthToken.TokenHash)

	if err != nil {
		log.Printf("Error deleting auth token: %v\n", err)
		http.Error(w, "Error deleting auth token: "+err.Error(), http.StatusInternalServerError)
		return
	}

	err = ClearAuthCookieIfBrowser(w, r)

	if err != nil {
		log.Printf("Error clearing auth cookie: %v\n", err)
		http.Error(w, "Error clearing auth cookie: "+err.Error(), http.StatusInternalServerError)
		return
	}

	err = ClearAccountFromCookies(w, r, auth.User.Id)

	if err != nil {
		log.Printf("Error clearing account from cookies: %v\n", err)
		http.Error(w, "Error clearing account from cookies: "+err.Error(), http.StatusInternalServerError)
		return
	}

	log.Println("Successfully signed out")
}

func GetOrgUserConfigHandler(w http.ResponseWriter, r *http.Request) {
	log.Println("Received request for GetOrgUserConfigHandler")

	auth := Authenticate(w, r, true)

View on GitHub (pinned to e2d772072e)

Solutions

1. Ensure no middleware or earlier code writes to the ResponseWriter before ClearAuthCookieIfBrowser runs
2. Inspect ClearAuthCookieIfBrowser for header-write errors (e.g. 'http: superfluous response.WriteHeader')
3. Set the expired cookie only via w.Header().Add("Set-Cookie", ...) before any body write
4. Confirm cookie domain/path on the clearing call exactly matches the cookie originally set, or browsers will not remove it

Example fix

// before
err = ClearAuthCookieIfBrowser(w, r)
if err != nil {
	http.Error(w, "Error clearing auth cookie: "+err.Error(), http.StatusInternalServerError)
	return
}
// after
err = ClearAuthCookieIfBrowser(w, r)
if err != nil {
	// cookie write failure should not block sign-out; token already invalidated server-side
	log.Printf("Error clearing auth cookie: %v\n", err)
}

// server-side pre-check: header not yet written before clearing cookies
_, wrote := w.(interface{ Written() bool })
if wrote && w.(http.Flusher) == nil {
	// only safe if nothing has been flushed; otherwise skip and log
	_ = w
}

func canSetCookies(w http.ResponseWriter) bool {
	// http.ResponseWriter allows header writes until WriteHeader/Flush is called
	_, isFlusher := w.(http.Flusher)
	return !isFlusher // conservative: skip cookie writes once flushing is possible/started
}

err := ClearAuthCookieIfBrowser(w, r)
if err != nil {
	// fall back to manually expiring the cookie
	http.SetCookie(w, &http.Cookie{Name: "auth_token", Value: "", Path: "/", MaxAge: -1})
}

When it happens

Trigger: Calling sign-out when response headers have already been flushed (anything wrote to w earlier in the request chain), or the cookie-clearing helper fails to construct/write the expired Set-Cookie header.

Common situations: Middleware already wrote a response body or headers before the handler ran, a middleware double-writes the header, or http: superfluous WriteHeader warnings accompany this error after header writes were attempted twice.

Related errors

• Error clearing account from cookies:
• token exchange failed - error creating request: %s
• token exchange failed - error reading body: %s
• token exchange failed - status: %d, body: %s
• failed to update context: %v

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/59f20916eced98f8. Report an issue: GitHub.