@strapi/admin 5.50.2 → 5.51.0

package/dist/admin/admin/src/utils/cookies.js

@@ -1,11 +1,54 @@
 'use strict';
 
+var authCookieDomain = require('../../../shared/utils/auth-cookie-domain.js');
 var authCookieName = require('../../../shared/utils/auth-cookie-name.js');
+var authCookiePath = require('../../../shared/utils/auth-cookie-path.js');
 
 /**
  * Resolved once at module load: the build inlines `admin.auth.cookie.name`
  * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_NAME`.
  */ const AUTH_COOKIE_NAME = authCookieName.resolveAuthCookieName(process.env.STRAPI_ADMIN_AUTH_COOKIE_NAME);
+/**
+ * Resolved once at module load: the build inlines `admin.auth.cookie.path`
+ * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_PATH`.
+ */ const AUTH_COOKIE_PATH = authCookiePath.resolveAuthCookiePath(process.env.STRAPI_ADMIN_AUTH_COOKIE_PATH);
+/**
+ * Resolved once at module load: the build inlines `admin.auth.cookie.domain`
+ * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN`. `undefined` means the
+ * cookie is host-only.
+ */ const AUTH_COOKIE_DOMAIN = authCookieDomain.resolveAuthCookieDomain(process.env.STRAPI_ADMIN_AUTH_COOKIE_DOMAIN);
+/** Paths previously used by the client for the access cookie; cleared on set/delete. */ const LEGACY_AUTH_COOKIE_PATHS = [
+    '/'
+];
+const expireCookieAt = (name, path, domain)=>{
+    const domainAttr = domain ? `; Domain=${domain}` : '';
+    document.cookie = `${name}=; Path=${path}${domainAttr}; Expires=Thu, 01 Jan 1970 00:00:01 GMT;`;
+};
+/**
+ * Every `(path, domain)` key the access cookie may live under: the configured
+ * key plus the legacy-path and host-only variants written by older versions or
+ * previous configs. The browser cookie store keys entries by
+ * `(name, domain, path)`, so each combination is a distinct entry.
+ */ const cookieKeyMatrix = ()=>{
+    const paths = new Set([
+        AUTH_COOKIE_PATH,
+        ...LEGACY_AUTH_COOKIE_PATHS
+    ]);
+    const domains = new Set([
+        undefined,
+        AUTH_COOKIE_DOMAIN
+    ]);
+    const matrix = [];
+    for (const path of paths){
+        for (const domain of domains){
+            matrix.push({
+                path,
+                domain
+            });
+        }
+    }
+    return matrix;
+};
 /**
  * Retrieves the value of a specified cookie.
  *
@@ -24,23 +67,55 @@ var authCookieName = require('../../../shared/utils/auth-cookie-name.js');
 };
 /**
  * Sets a cookie with the given name, value, and optional expiration time.
+ * Uses `admin.auth.cookie.path` and `admin.auth.cookie.domain` (both inlined
+ * at build time) so the access cookie stays scoped to the same path and domain
+ * as the httpOnly refresh cookie and the EE SSO access cookie. The cookie is
+ * marked `Secure` whenever the page is served over TLS.
  *
  * @param name - The name of the cookie.
  * @param value - The value of the cookie.
  * @param days - (Optional) Number of days until the cookie expires. If omitted, the cookie is a session cookie.
  */ const setCookie = (name, value, days)=>{
     let expires = '';
-    document.cookie = `${name}=${encodeURIComponent(value)}; Path=/${expires}`;
+    // Expire every other key the cookie may live under (legacy Path=/, host-only
+    // copies written before a domain was configured). A stale same-name entry at
+    // an equal-length path sorts first in document.cookie by creation time
+    // (RFC 6265 §5.4), so leaving one behind would shadow the token written below.
+    for (const { path, domain } of cookieKeyMatrix()){
+        if (path !== AUTH_COOKIE_PATH || domain !== AUTH_COOKIE_DOMAIN) {
+            expireCookieAt(name, path, domain);
+        }
+    }
+    const domainAttr = AUTH_COOKIE_DOMAIN ? `; Domain=${AUTH_COOKIE_DOMAIN}` : '';
+    // Mark the token Secure when the page itself is served over TLS — the
+    // browser's own criterion — so it is never attached to plain-http requests.
+    // Expiry writes stay flag-free on purpose: deletion targets the (name,
+    // domain, path) key regardless of Secure, and from an http origin a
+    // flag-free write can still clear non-Secure entries (no origin can carry
+    // the Secure flag over http, and Secure entries are untouchable from there
+    // either way).
+    const secureAttr = window.location.protocol === 'https:' ? '; Secure' : '';
+    document.cookie = `${name}=${encodeURIComponent(value)}; Path=${AUTH_COOKIE_PATH}${domainAttr}${expires}${secureAttr}`;
 };
 /**
  * Deletes a cookie by setting its expiration date to a past date.
  *
+ * Expires every combination of {configured path, legacy Path=/} and
+ * {configured domain, host-only}. A `Domain`-scoped cookie is a distinct entry
+ * from a host-only one in the browser cookie store, so both must be cleared or
+ * remote logout leaves the EE SSO cookie (written with `Domain` by the server)
+ * behind, rehydrating a dead session into an infinite login redirect.
+ *
  * @param name - The name of the cookie to delete.
  */ const deleteCookie = (name)=>{
-    document.cookie = `${name}=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT;`;
+    for (const { path, domain } of cookieKeyMatrix()){
+        expireCookieAt(name, path, domain);
+    }
 };
 
+exports.AUTH_COOKIE_DOMAIN = AUTH_COOKIE_DOMAIN;
 exports.AUTH_COOKIE_NAME = AUTH_COOKIE_NAME;
+exports.AUTH_COOKIE_PATH = AUTH_COOKIE_PATH;
 exports.deleteCookie = deleteCookie;
 exports.getCookieValue = getCookieValue;
 exports.setCookie = setCookie;

package/dist/admin/admin/src/utils/cookies.js.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.js","sources":["../../../../../admin/src/utils/cookies.ts"],"sourcesContent":["import { resolveAuthCookieName } from '../../../shared/utils/auth-cookie-name';\n\n/**\n * Resolved once at module load: the build inlines `admin.auth.cookie.name`\n * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_NAME`.\n */\nexport const AUTH_COOKIE_NAME = resolveAuthCookieName(process.env.STRAPI_ADMIN_AUTH_COOKIE_NAME);\n\n/**\n * Retrieves the value of a specified cookie.\n *\n * @param name - The name of the cookie to retrieve.\n * @returns The decoded cookie value if found, otherwise null.\n */\nexport const getCookieValue = (name: string): string | null => {\n  let result = null;\n  const cookieArray = document.cookie.split(';');\n  cookieArray.forEach((cookie) => {\n    const [key, value] = cookie.split('=').map((item) => item.trim());\n    if (key === name) {\n      result = decodeURIComponent(value);\n    }\n  });\n  return result;\n};\n\n/**\n * Sets a cookie with the given name, value, and optional expiration time.\n *\n * @param name - The name of the cookie.\n * @param value - The value of the cookie.\n * @param days - (Optional) Number of days until the cookie expires. If omitted, the cookie is a session cookie.\n */\nexport const setCookie = (name: string, value: string, days?: number): void => {\n  let expires = '';\n  if (days) {\n    const date = new Date();\n    date.setTime(date.getTime() + days * 24 * 60 * 60 * 1000);\n    expires = `; Expires=${date.toUTCString()}`;\n  }\n  document.cookie = `${name}=${encodeURIComponent(value)}; Path=/${expires}`;\n};\n\n/**\n * Deletes a cookie by setting its expiration date to a past date.\n *\n * @param name - The name of the cookie to delete.\n */\nexport const deleteCookie = (name: string): void => {\n  document.cookie = `${name}=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT;`;\n};\n"],"names":["AUTH_COOKIE_NAME","resolveAuthCookieName","process","env","STRAPI_ADMIN_AUTH_COOKIE_NAME","getCookieValue","name","result","cookieArray","document","cookie","split","forEach","key","value","map","item","trim","decodeURIComponent","setCookie","days","expires","encodeURIComponent","deleteCookie"],"mappings":";;;;AAEA;;;UAIaA,gBAAAA,GAAmBC,oCAAAA,CAAsBC,QAAQC,GAAG,CAACC,6BAA6B;AAE/F;;;;;IAMO,MAAMC,cAAAA,GAAiB,CAACC,IAAAA,GAAAA;AAC7B,IAAA,IAAIC,MAAAA,GAAS,IAAA;AACb,IAAA,MAAMC,WAAAA,GAAcC,QAAAA,CAASC,MAAM,CAACC,KAAK,CAAC,GAAA,CAAA;IAC1CH,WAAAA,CAAYI,OAAO,CAAC,CAACF,MAAAA,GAAAA;AACnB,QAAA,MAAM,CAACG,GAAAA,EAAKC,KAAAA,CAAM,GAAGJ,MAAAA,CAAOC,KAAK,CAAC,GAAA,CAAA,CAAKI,GAAG,CAAC,CAACC,IAAAA,GAASA,KAAKC,IAAI,EAAA,CAAA;AAC9D,QAAA,IAAIJ,QAAQP,IAAAA,EAAM;AAChBC,YAAAA,MAAAA,GAASW,kBAAAA,CAAmBJ,KAAAA,CAAAA;AAC9B,QAAA;AACF,IAAA,CAAA,CAAA;IACA,OAAOP,MAAAA;AACT;AAEA;;;;;;AAMC,IACM,MAAMY,SAAAA,GAAY,CAACb,MAAcQ,KAAAA,EAAeM,IAAAA,GAAAA;AACrD,IAAA,IAAIC,OAAAA,GAAU,EAAA;IAMdZ,QAAAA,CAASC,MAAM,GAAG,CAAA,EAAGJ,IAAAA,CAAK,CAAC,EAAEgB,kBAAAA,CAAmBR,KAAAA,CAAAA,CAAO,QAAQ,EAAEO,OAAAA,CAAAA,CAAS;AAC5E;AAEA;;;;IAKO,MAAME,YAAAA,GAAe,CAACjB,IAAAA,GAAAA;AAC3BG,IAAAA,QAAAA,CAASC,MAAM,GAAG,CAAA,EAAGJ,IAAAA,CAAK,iDAAiD,CAAC;AAC9E;;;;;;;"}
+{"version":3,"file":"cookies.js","sources":["../../../../../admin/src/utils/cookies.ts"],"sourcesContent":["import { resolveAuthCookieDomain } from '../../../shared/utils/auth-cookie-domain';\nimport { resolveAuthCookieName } from '../../../shared/utils/auth-cookie-name';\nimport { resolveAuthCookiePath } from '../../../shared/utils/auth-cookie-path';\n\n/**\n * Resolved once at module load: the build inlines `admin.auth.cookie.name`\n * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_NAME`.\n */\nexport const AUTH_COOKIE_NAME = resolveAuthCookieName(process.env.STRAPI_ADMIN_AUTH_COOKIE_NAME);\n\n/**\n * Resolved once at module load: the build inlines `admin.auth.cookie.path`\n * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_PATH`.\n */\nexport const AUTH_COOKIE_PATH = resolveAuthCookiePath(process.env.STRAPI_ADMIN_AUTH_COOKIE_PATH);\n\n/**\n * Resolved once at module load: the build inlines `admin.auth.cookie.domain`\n * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN`. `undefined` means the\n * cookie is host-only.\n */\nexport const AUTH_COOKIE_DOMAIN = resolveAuthCookieDomain(\n  process.env.STRAPI_ADMIN_AUTH_COOKIE_DOMAIN\n);\n\n/** Paths previously used by the client for the access cookie; cleared on set/delete. */\nconst LEGACY_AUTH_COOKIE_PATHS = ['/'] as const;\n\nconst expireCookieAt = (name: string, path: string, domain?: string): void => {\n  const domainAttr = domain ? `; Domain=${domain}` : '';\n  document.cookie = `${name}=; Path=${path}${domainAttr}; Expires=Thu, 01 Jan 1970 00:00:01 GMT;`;\n};\n\n/**\n * Every `(path, domain)` key the access cookie may live under: the configured\n * key plus the legacy-path and host-only variants written by older versions or\n * previous configs. The browser cookie store keys entries by\n * `(name, domain, path)`, so each combination is a distinct entry.\n */\nconst cookieKeyMatrix = (): Array<{ path: string; domain: string | undefined }> => {\n  const paths = new Set<string>([AUTH_COOKIE_PATH, ...LEGACY_AUTH_COOKIE_PATHS]);\n  const domains = new Set<string | undefined>([undefined, AUTH_COOKIE_DOMAIN]);\n\n  const matrix: Array<{ path: string; domain: string | undefined }> = [];\n  for (const path of paths) {\n    for (const domain of domains) {\n      matrix.push({ path, domain });\n    }\n  }\n  return matrix;\n};\n\n/**\n * Retrieves the value of a specified cookie.\n *\n * @param name - The name of the cookie to retrieve.\n * @returns The decoded cookie value if found, otherwise null.\n */\nexport const getCookieValue = (name: string): string | null => {\n  let result = null;\n  const cookieArray = document.cookie.split(';');\n  cookieArray.forEach((cookie) => {\n    const [key, value] = cookie.split('=').map((item) => item.trim());\n    if (key === name) {\n      result = decodeURIComponent(value);\n    }\n  });\n  return result;\n};\n\n/**\n * Sets a cookie with the given name, value, and optional expiration time.\n * Uses `admin.auth.cookie.path` and `admin.auth.cookie.domain` (both inlined\n * at build time) so the access cookie stays scoped to the same path and domain\n * as the httpOnly refresh cookie and the EE SSO access cookie. The cookie is\n * marked `Secure` whenever the page is served over TLS.\n *\n * @param name - The name of the cookie.\n * @param value - The value of the cookie.\n * @param days - (Optional) Number of days until the cookie expires. If omitted, the cookie is a session cookie.\n */\nexport const setCookie = (name: string, value: string, days?: number): void => {\n  let expires = '';\n  if (days) {\n    const date = new Date();\n    date.setTime(date.getTime() + days * 24 * 60 * 60 * 1000);\n    expires = `; Expires=${date.toUTCString()}`;\n  }\n\n  // Expire every other key the cookie may live under (legacy Path=/, host-only\n  // copies written before a domain was configured). A stale same-name entry at\n  // an equal-length path sorts first in document.cookie by creation time\n  // (RFC 6265 §5.4), so leaving one behind would shadow the token written below.\n  for (const { path, domain } of cookieKeyMatrix()) {\n    if (path !== AUTH_COOKIE_PATH || domain !== AUTH_COOKIE_DOMAIN) {\n      expireCookieAt(name, path, domain);\n    }\n  }\n\n  const domainAttr = AUTH_COOKIE_DOMAIN ? `; Domain=${AUTH_COOKIE_DOMAIN}` : '';\n  // Mark the token Secure when the page itself is served over TLS — the\n  // browser's own criterion — so it is never attached to plain-http requests.\n  // Expiry writes stay flag-free on purpose: deletion targets the (name,\n  // domain, path) key regardless of Secure, and from an http origin a\n  // flag-free write can still clear non-Secure entries (no origin can carry\n  // the Secure flag over http, and Secure entries are untouchable from there\n  // either way).\n  const secureAttr = window.location.protocol === 'https:' ? '; Secure' : '';\n  document.cookie = `${name}=${encodeURIComponent(value)}; Path=${AUTH_COOKIE_PATH}${domainAttr}${expires}${secureAttr}`;\n};\n\n/**\n * Deletes a cookie by setting its expiration date to a past date.\n *\n * Expires every combination of {configured path, legacy Path=/} and\n * {configured domain, host-only}. A `Domain`-scoped cookie is a distinct entry\n * from a host-only one in the browser cookie store, so both must be cleared or\n * remote logout leaves the EE SSO cookie (written with `Domain` by the server)\n * behind, rehydrating a dead session into an infinite login redirect.\n *\n * @param name - The name of the cookie to delete.\n */\nexport const deleteCookie = (name: string): void => {\n  for (const { path, domain } of cookieKeyMatrix()) {\n    expireCookieAt(name, path, domain);\n  }\n};\n"],"names":["AUTH_COOKIE_NAME","resolveAuthCookieName","process","env","STRAPI_ADMIN_AUTH_COOKIE_NAME","AUTH_COOKIE_PATH","resolveAuthCookiePath","STRAPI_ADMIN_AUTH_COOKIE_PATH","AUTH_COOKIE_DOMAIN","resolveAuthCookieDomain","STRAPI_ADMIN_AUTH_COOKIE_DOMAIN","LEGACY_AUTH_COOKIE_PATHS","expireCookieAt","name","path","domain","domainAttr","document","cookie","cookieKeyMatrix","paths","Set","domains","undefined","matrix","push","getCookieValue","result","cookieArray","split","forEach","key","value","map","item","trim","decodeURIComponent","setCookie","days","expires","secureAttr","window","location","protocol","encodeURIComponent","deleteCookie"],"mappings":";;;;;;AAIA;;;UAIaA,gBAAAA,GAAmBC,oCAAAA,CAAsBC,QAAQC,GAAG,CAACC,6BAA6B;AAE/F;;;UAIaC,gBAAAA,GAAmBC,oCAAAA,CAAsBJ,QAAQC,GAAG,CAACI,6BAA6B;AAE/F;;;;UAKaC,kBAAAA,GAAqBC,wCAAAA,CAChCP,QAAQC,GAAG,CAACO,+BAA+B;AAG7C,yFACA,MAAMC,wBAAAA,GAA2B;AAAC,IAAA;AAAI,CAAA;AAEtC,MAAMC,cAAAA,GAAiB,CAACC,IAAAA,EAAcC,IAAAA,EAAcC,MAAAA,GAAAA;AAClD,IAAA,MAAMC,aAAaD,MAAAA,GAAS,CAAC,SAAS,EAAEA,QAAQ,GAAG,EAAA;IACnDE,QAAAA,CAASC,MAAM,GAAG,CAAA,EAAGL,IAAAA,CAAK,QAAQ,EAAEC,IAAAA,CAAAA,EAAOE,UAAAA,CAAW,wCAAwC,CAAC;AACjG,CAAA;AAEA;;;;;AAKC,IACD,MAAMG,eAAAA,GAAkB,IAAA;IACtB,MAAMC,KAAAA,GAAQ,IAAIC,GAAAA,CAAY;AAAChB,QAAAA,gBAAAA;AAAqBM,QAAAA,GAAAA;AAAyB,KAAA,CAAA;IAC7E,MAAMW,OAAAA,GAAU,IAAID,GAAAA,CAAwB;AAACE,QAAAA,SAAAA;AAAWf,QAAAA;AAAmB,KAAA,CAAA;AAE3E,IAAA,MAAMgB,SAA8D,EAAE;IACtE,KAAK,MAAMV,QAAQM,KAAAA,CAAO;QACxB,KAAK,MAAML,UAAUO,OAAAA,CAAS;AAC5BE,YAAAA,MAAAA,CAAOC,IAAI,CAAC;AAAEX,gBAAAA,IAAAA;AAAMC,gBAAAA;AAAO,aAAA,CAAA;AAC7B,QAAA;AACF,IAAA;IACA,OAAOS,MAAAA;AACT,CAAA;AAEA;;;;;IAMO,MAAME,cAAAA,GAAiB,CAACb,IAAAA,GAAAA;AAC7B,IAAA,IAAIc,MAAAA,GAAS,IAAA;AACb,IAAA,MAAMC,WAAAA,GAAcX,QAAAA,CAASC,MAAM,CAACW,KAAK,CAAC,GAAA,CAAA;IAC1CD,WAAAA,CAAYE,OAAO,CAAC,CAACZ,MAAAA,GAAAA;AACnB,QAAA,MAAM,CAACa,GAAAA,EAAKC,KAAAA,CAAM,GAAGd,MAAAA,CAAOW,KAAK,CAAC,GAAA,CAAA,CAAKI,GAAG,CAAC,CAACC,IAAAA,GAASA,KAAKC,IAAI,EAAA,CAAA;AAC9D,QAAA,IAAIJ,QAAQlB,IAAAA,EAAM;AAChBc,YAAAA,MAAAA,GAASS,kBAAAA,CAAmBJ,KAAAA,CAAAA;AAC9B,QAAA;AACF,IAAA,CAAA,CAAA;IACA,OAAOL,MAAAA;AACT;AAEA;;;;;;;;;;AAUC,IACM,MAAMU,SAAAA,GAAY,CAACxB,MAAcmB,KAAAA,EAAeM,IAAAA,GAAAA;AACrD,IAAA,IAAIC,OAAAA,GAAU,EAAA;;;;;AAWd,IAAA,KAAK,MAAM,EAAEzB,IAAI,EAAEC,MAAM,EAAE,IAAII,eAAAA,EAAAA,CAAmB;QAChD,IAAIL,IAAAA,KAAST,gBAAAA,IAAoBU,MAAAA,KAAWP,kBAAAA,EAAoB;AAC9DI,YAAAA,cAAAA,CAAeC,MAAMC,IAAAA,EAAMC,MAAAA,CAAAA;AAC7B,QAAA;AACF,IAAA;AAEA,IAAA,MAAMC,aAAaR,kBAAAA,GAAqB,CAAC,SAAS,EAAEA,oBAAoB,GAAG,EAAA;;;;;;;;AAQ3E,IAAA,MAAMgC,aAAaC,MAAAA,CAAOC,QAAQ,CAACC,QAAQ,KAAK,WAAW,UAAA,GAAa,EAAA;AACxE1B,IAAAA,QAAAA,CAASC,MAAM,GAAG,CAAA,EAAGL,IAAAA,CAAK,CAAC,EAAE+B,kBAAAA,CAAmBZ,KAAAA,CAAAA,CAAO,OAAO,EAAE3B,gBAAAA,CAAAA,EAAmBW,UAAAA,CAAAA,EAAauB,UAAUC,UAAAA,CAAAA,CAAY;AACxH;AAEA;;;;;;;;;;IAWO,MAAMK,YAAAA,GAAe,CAAChC,IAAAA,GAAAA;AAC3B,IAAA,KAAK,MAAM,EAAEC,IAAI,EAAEC,MAAM,EAAE,IAAII,eAAAA,EAAAA,CAAmB;AAChDP,QAAAA,cAAAA,CAAeC,MAAMC,IAAAA,EAAMC,MAAAA,CAAAA;AAC7B,IAAA;AACF;;;;;;;;;"}

package/dist/admin/admin/src/utils/cookies.mjs

@@ -1,9 +1,52 @@
+import { resolveAuthCookieDomain } from '../../../shared/utils/auth-cookie-domain.mjs';
 import { resolveAuthCookieName } from '../../../shared/utils/auth-cookie-name.mjs';
+import { resolveAuthCookiePath } from '../../../shared/utils/auth-cookie-path.mjs';
 
 /**
  * Resolved once at module load: the build inlines `admin.auth.cookie.name`
  * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_NAME`.
  */ const AUTH_COOKIE_NAME = resolveAuthCookieName(process.env.STRAPI_ADMIN_AUTH_COOKIE_NAME);
+/**
+ * Resolved once at module load: the build inlines `admin.auth.cookie.path`
+ * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_PATH`.
+ */ const AUTH_COOKIE_PATH = resolveAuthCookiePath(process.env.STRAPI_ADMIN_AUTH_COOKIE_PATH);
+/**
+ * Resolved once at module load: the build inlines `admin.auth.cookie.domain`
+ * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN`. `undefined` means the
+ * cookie is host-only.
+ */ const AUTH_COOKIE_DOMAIN = resolveAuthCookieDomain(process.env.STRAPI_ADMIN_AUTH_COOKIE_DOMAIN);
+/** Paths previously used by the client for the access cookie; cleared on set/delete. */ const LEGACY_AUTH_COOKIE_PATHS = [
+    '/'
+];
+const expireCookieAt = (name, path, domain)=>{
+    const domainAttr = domain ? `; Domain=${domain}` : '';
+    document.cookie = `${name}=; Path=${path}${domainAttr}; Expires=Thu, 01 Jan 1970 00:00:01 GMT;`;
+};
+/**
+ * Every `(path, domain)` key the access cookie may live under: the configured
+ * key plus the legacy-path and host-only variants written by older versions or
+ * previous configs. The browser cookie store keys entries by
+ * `(name, domain, path)`, so each combination is a distinct entry.
+ */ const cookieKeyMatrix = ()=>{
+    const paths = new Set([
+        AUTH_COOKIE_PATH,
+        ...LEGACY_AUTH_COOKIE_PATHS
+    ]);
+    const domains = new Set([
+        undefined,
+        AUTH_COOKIE_DOMAIN
+    ]);
+    const matrix = [];
+    for (const path of paths){
+        for (const domain of domains){
+            matrix.push({
+                path,
+                domain
+            });
+        }
+    }
+    return matrix;
+};
 /**
  * Retrieves the value of a specified cookie.
  *
@@ -22,21 +65,51 @@ import { resolveAuthCookieName } from '../../../shared/utils/auth-cookie-name.mj
 };
 /**
  * Sets a cookie with the given name, value, and optional expiration time.
+ * Uses `admin.auth.cookie.path` and `admin.auth.cookie.domain` (both inlined
+ * at build time) so the access cookie stays scoped to the same path and domain
+ * as the httpOnly refresh cookie and the EE SSO access cookie. The cookie is
+ * marked `Secure` whenever the page is served over TLS.
  *
  * @param name - The name of the cookie.
  * @param value - The value of the cookie.
  * @param days - (Optional) Number of days until the cookie expires. If omitted, the cookie is a session cookie.
  */ const setCookie = (name, value, days)=>{
     let expires = '';
-    document.cookie = `${name}=${encodeURIComponent(value)}; Path=/${expires}`;
+    // Expire every other key the cookie may live under (legacy Path=/, host-only
+    // copies written before a domain was configured). A stale same-name entry at
+    // an equal-length path sorts first in document.cookie by creation time
+    // (RFC 6265 §5.4), so leaving one behind would shadow the token written below.
+    for (const { path, domain } of cookieKeyMatrix()){
+        if (path !== AUTH_COOKIE_PATH || domain !== AUTH_COOKIE_DOMAIN) {
+            expireCookieAt(name, path, domain);
+        }
+    }
+    const domainAttr = AUTH_COOKIE_DOMAIN ? `; Domain=${AUTH_COOKIE_DOMAIN}` : '';
+    // Mark the token Secure when the page itself is served over TLS — the
+    // browser's own criterion — so it is never attached to plain-http requests.
+    // Expiry writes stay flag-free on purpose: deletion targets the (name,
+    // domain, path) key regardless of Secure, and from an http origin a
+    // flag-free write can still clear non-Secure entries (no origin can carry
+    // the Secure flag over http, and Secure entries are untouchable from there
+    // either way).
+    const secureAttr = window.location.protocol === 'https:' ? '; Secure' : '';
+    document.cookie = `${name}=${encodeURIComponent(value)}; Path=${AUTH_COOKIE_PATH}${domainAttr}${expires}${secureAttr}`;
 };
 /**
  * Deletes a cookie by setting its expiration date to a past date.
  *
+ * Expires every combination of {configured path, legacy Path=/} and
+ * {configured domain, host-only}. A `Domain`-scoped cookie is a distinct entry
+ * from a host-only one in the browser cookie store, so both must be cleared or
+ * remote logout leaves the EE SSO cookie (written with `Domain` by the server)
+ * behind, rehydrating a dead session into an infinite login redirect.
+ *
  * @param name - The name of the cookie to delete.
  */ const deleteCookie = (name)=>{
-    document.cookie = `${name}=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT;`;
+    for (const { path, domain } of cookieKeyMatrix()){
+        expireCookieAt(name, path, domain);
+    }
 };
 
-export { AUTH_COOKIE_NAME, deleteCookie, getCookieValue, setCookie };
+export { AUTH_COOKIE_DOMAIN, AUTH_COOKIE_NAME, AUTH_COOKIE_PATH, deleteCookie, getCookieValue, setCookie };
 //# sourceMappingURL=cookies.mjs.map

package/dist/admin/admin/src/utils/cookies.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.mjs","sources":["../../../../../admin/src/utils/cookies.ts"],"sourcesContent":["import { resolveAuthCookieName } from '../../../shared/utils/auth-cookie-name';\n\n/**\n * Resolved once at module load: the build inlines `admin.auth.cookie.name`\n * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_NAME`.\n */\nexport const AUTH_COOKIE_NAME = resolveAuthCookieName(process.env.STRAPI_ADMIN_AUTH_COOKIE_NAME);\n\n/**\n * Retrieves the value of a specified cookie.\n *\n * @param name - The name of the cookie to retrieve.\n * @returns The decoded cookie value if found, otherwise null.\n */\nexport const getCookieValue = (name: string): string | null => {\n  let result = null;\n  const cookieArray = document.cookie.split(';');\n  cookieArray.forEach((cookie) => {\n    const [key, value] = cookie.split('=').map((item) => item.trim());\n    if (key === name) {\n      result = decodeURIComponent(value);\n    }\n  });\n  return result;\n};\n\n/**\n * Sets a cookie with the given name, value, and optional expiration time.\n *\n * @param name - The name of the cookie.\n * @param value - The value of the cookie.\n * @param days - (Optional) Number of days until the cookie expires. If omitted, the cookie is a session cookie.\n */\nexport const setCookie = (name: string, value: string, days?: number): void => {\n  let expires = '';\n  if (days) {\n    const date = new Date();\n    date.setTime(date.getTime() + days * 24 * 60 * 60 * 1000);\n    expires = `; Expires=${date.toUTCString()}`;\n  }\n  document.cookie = `${name}=${encodeURIComponent(value)}; Path=/${expires}`;\n};\n\n/**\n * Deletes a cookie by setting its expiration date to a past date.\n *\n * @param name - The name of the cookie to delete.\n */\nexport const deleteCookie = (name: string): void => {\n  document.cookie = `${name}=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT;`;\n};\n"],"names":["AUTH_COOKIE_NAME","resolveAuthCookieName","process","env","STRAPI_ADMIN_AUTH_COOKIE_NAME","getCookieValue","name","result","cookieArray","document","cookie","split","forEach","key","value","map","item","trim","decodeURIComponent","setCookie","days","expires","encodeURIComponent","deleteCookie"],"mappings":";;AAEA;;;UAIaA,gBAAAA,GAAmBC,qBAAAA,CAAsBC,QAAQC,GAAG,CAACC,6BAA6B;AAE/F;;;;;IAMO,MAAMC,cAAAA,GAAiB,CAACC,IAAAA,GAAAA;AAC7B,IAAA,IAAIC,MAAAA,GAAS,IAAA;AACb,IAAA,MAAMC,WAAAA,GAAcC,QAAAA,CAASC,MAAM,CAACC,KAAK,CAAC,GAAA,CAAA;IAC1CH,WAAAA,CAAYI,OAAO,CAAC,CAACF,MAAAA,GAAAA;AACnB,QAAA,MAAM,CAACG,GAAAA,EAAKC,KAAAA,CAAM,GAAGJ,MAAAA,CAAOC,KAAK,CAAC,GAAA,CAAA,CAAKI,GAAG,CAAC,CAACC,IAAAA,GAASA,KAAKC,IAAI,EAAA,CAAA;AAC9D,QAAA,IAAIJ,QAAQP,IAAAA,EAAM;AAChBC,YAAAA,MAAAA,GAASW,kBAAAA,CAAmBJ,KAAAA,CAAAA;AAC9B,QAAA;AACF,IAAA,CAAA,CAAA;IACA,OAAOP,MAAAA;AACT;AAEA;;;;;;AAMC,IACM,MAAMY,SAAAA,GAAY,CAACb,MAAcQ,KAAAA,EAAeM,IAAAA,GAAAA;AACrD,IAAA,IAAIC,OAAAA,GAAU,EAAA;IAMdZ,QAAAA,CAASC,MAAM,GAAG,CAAA,EAAGJ,IAAAA,CAAK,CAAC,EAAEgB,kBAAAA,CAAmBR,KAAAA,CAAAA,CAAO,QAAQ,EAAEO,OAAAA,CAAAA,CAAS;AAC5E;AAEA;;;;IAKO,MAAME,YAAAA,GAAe,CAACjB,IAAAA,GAAAA;AAC3BG,IAAAA,QAAAA,CAASC,MAAM,GAAG,CAAA,EAAGJ,IAAAA,CAAK,iDAAiD,CAAC;AAC9E;;;;"}
+{"version":3,"file":"cookies.mjs","sources":["../../../../../admin/src/utils/cookies.ts"],"sourcesContent":["import { resolveAuthCookieDomain } from '../../../shared/utils/auth-cookie-domain';\nimport { resolveAuthCookieName } from '../../../shared/utils/auth-cookie-name';\nimport { resolveAuthCookiePath } from '../../../shared/utils/auth-cookie-path';\n\n/**\n * Resolved once at module load: the build inlines `admin.auth.cookie.name`\n * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_NAME`.\n */\nexport const AUTH_COOKIE_NAME = resolveAuthCookieName(process.env.STRAPI_ADMIN_AUTH_COOKIE_NAME);\n\n/**\n * Resolved once at module load: the build inlines `admin.auth.cookie.path`\n * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_PATH`.\n */\nexport const AUTH_COOKIE_PATH = resolveAuthCookiePath(process.env.STRAPI_ADMIN_AUTH_COOKIE_PATH);\n\n/**\n * Resolved once at module load: the build inlines `admin.auth.cookie.domain`\n * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN`. `undefined` means the\n * cookie is host-only.\n */\nexport const AUTH_COOKIE_DOMAIN = resolveAuthCookieDomain(\n  process.env.STRAPI_ADMIN_AUTH_COOKIE_DOMAIN\n);\n\n/** Paths previously used by the client for the access cookie; cleared on set/delete. */\nconst LEGACY_AUTH_COOKIE_PATHS = ['/'] as const;\n\nconst expireCookieAt = (name: string, path: string, domain?: string): void => {\n  const domainAttr = domain ? `; Domain=${domain}` : '';\n  document.cookie = `${name}=; Path=${path}${domainAttr}; Expires=Thu, 01 Jan 1970 00:00:01 GMT;`;\n};\n\n/**\n * Every `(path, domain)` key the access cookie may live under: the configured\n * key plus the legacy-path and host-only variants written by older versions or\n * previous configs. The browser cookie store keys entries by\n * `(name, domain, path)`, so each combination is a distinct entry.\n */\nconst cookieKeyMatrix = (): Array<{ path: string; domain: string | undefined }> => {\n  const paths = new Set<string>([AUTH_COOKIE_PATH, ...LEGACY_AUTH_COOKIE_PATHS]);\n  const domains = new Set<string | undefined>([undefined, AUTH_COOKIE_DOMAIN]);\n\n  const matrix: Array<{ path: string; domain: string | undefined }> = [];\n  for (const path of paths) {\n    for (const domain of domains) {\n      matrix.push({ path, domain });\n    }\n  }\n  return matrix;\n};\n\n/**\n * Retrieves the value of a specified cookie.\n *\n * @param name - The name of the cookie to retrieve.\n * @returns The decoded cookie value if found, otherwise null.\n */\nexport const getCookieValue = (name: string): string | null => {\n  let result = null;\n  const cookieArray = document.cookie.split(';');\n  cookieArray.forEach((cookie) => {\n    const [key, value] = cookie.split('=').map((item) => item.trim());\n    if (key === name) {\n      result = decodeURIComponent(value);\n    }\n  });\n  return result;\n};\n\n/**\n * Sets a cookie with the given name, value, and optional expiration time.\n * Uses `admin.auth.cookie.path` and `admin.auth.cookie.domain` (both inlined\n * at build time) so the access cookie stays scoped to the same path and domain\n * as the httpOnly refresh cookie and the EE SSO access cookie. The cookie is\n * marked `Secure` whenever the page is served over TLS.\n *\n * @param name - The name of the cookie.\n * @param value - The value of the cookie.\n * @param days - (Optional) Number of days until the cookie expires. If omitted, the cookie is a session cookie.\n */\nexport const setCookie = (name: string, value: string, days?: number): void => {\n  let expires = '';\n  if (days) {\n    const date = new Date();\n    date.setTime(date.getTime() + days * 24 * 60 * 60 * 1000);\n    expires = `; Expires=${date.toUTCString()}`;\n  }\n\n  // Expire every other key the cookie may live under (legacy Path=/, host-only\n  // copies written before a domain was configured). A stale same-name entry at\n  // an equal-length path sorts first in document.cookie by creation time\n  // (RFC 6265 §5.4), so leaving one behind would shadow the token written below.\n  for (const { path, domain } of cookieKeyMatrix()) {\n    if (path !== AUTH_COOKIE_PATH || domain !== AUTH_COOKIE_DOMAIN) {\n      expireCookieAt(name, path, domain);\n    }\n  }\n\n  const domainAttr = AUTH_COOKIE_DOMAIN ? `; Domain=${AUTH_COOKIE_DOMAIN}` : '';\n  // Mark the token Secure when the page itself is served over TLS — the\n  // browser's own criterion — so it is never attached to plain-http requests.\n  // Expiry writes stay flag-free on purpose: deletion targets the (name,\n  // domain, path) key regardless of Secure, and from an http origin a\n  // flag-free write can still clear non-Secure entries (no origin can carry\n  // the Secure flag over http, and Secure entries are untouchable from there\n  // either way).\n  const secureAttr = window.location.protocol === 'https:' ? '; Secure' : '';\n  document.cookie = `${name}=${encodeURIComponent(value)}; Path=${AUTH_COOKIE_PATH}${domainAttr}${expires}${secureAttr}`;\n};\n\n/**\n * Deletes a cookie by setting its expiration date to a past date.\n *\n * Expires every combination of {configured path, legacy Path=/} and\n * {configured domain, host-only}. A `Domain`-scoped cookie is a distinct entry\n * from a host-only one in the browser cookie store, so both must be cleared or\n * remote logout leaves the EE SSO cookie (written with `Domain` by the server)\n * behind, rehydrating a dead session into an infinite login redirect.\n *\n * @param name - The name of the cookie to delete.\n */\nexport const deleteCookie = (name: string): void => {\n  for (const { path, domain } of cookieKeyMatrix()) {\n    expireCookieAt(name, path, domain);\n  }\n};\n"],"names":["AUTH_COOKIE_NAME","resolveAuthCookieName","process","env","STRAPI_ADMIN_AUTH_COOKIE_NAME","AUTH_COOKIE_PATH","resolveAuthCookiePath","STRAPI_ADMIN_AUTH_COOKIE_PATH","AUTH_COOKIE_DOMAIN","resolveAuthCookieDomain","STRAPI_ADMIN_AUTH_COOKIE_DOMAIN","LEGACY_AUTH_COOKIE_PATHS","expireCookieAt","name","path","domain","domainAttr","document","cookie","cookieKeyMatrix","paths","Set","domains","undefined","matrix","push","getCookieValue","result","cookieArray","split","forEach","key","value","map","item","trim","decodeURIComponent","setCookie","days","expires","secureAttr","window","location","protocol","encodeURIComponent","deleteCookie"],"mappings":";;;;AAIA;;;UAIaA,gBAAAA,GAAmBC,qBAAAA,CAAsBC,QAAQC,GAAG,CAACC,6BAA6B;AAE/F;;;UAIaC,gBAAAA,GAAmBC,qBAAAA,CAAsBJ,QAAQC,GAAG,CAACI,6BAA6B;AAE/F;;;;UAKaC,kBAAAA,GAAqBC,uBAAAA,CAChCP,QAAQC,GAAG,CAACO,+BAA+B;AAG7C,yFACA,MAAMC,wBAAAA,GAA2B;AAAC,IAAA;AAAI,CAAA;AAEtC,MAAMC,cAAAA,GAAiB,CAACC,IAAAA,EAAcC,IAAAA,EAAcC,MAAAA,GAAAA;AAClD,IAAA,MAAMC,aAAaD,MAAAA,GAAS,CAAC,SAAS,EAAEA,QAAQ,GAAG,EAAA;IACnDE,QAAAA,CAASC,MAAM,GAAG,CAAA,EAAGL,IAAAA,CAAK,QAAQ,EAAEC,IAAAA,CAAAA,EAAOE,UAAAA,CAAW,wCAAwC,CAAC;AACjG,CAAA;AAEA;;;;;AAKC,IACD,MAAMG,eAAAA,GAAkB,IAAA;IACtB,MAAMC,KAAAA,GAAQ,IAAIC,GAAAA,CAAY;AAAChB,QAAAA,gBAAAA;AAAqBM,QAAAA,GAAAA;AAAyB,KAAA,CAAA;IAC7E,MAAMW,OAAAA,GAAU,IAAID,GAAAA,CAAwB;AAACE,QAAAA,SAAAA;AAAWf,QAAAA;AAAmB,KAAA,CAAA;AAE3E,IAAA,MAAMgB,SAA8D,EAAE;IACtE,KAAK,MAAMV,QAAQM,KAAAA,CAAO;QACxB,KAAK,MAAML,UAAUO,OAAAA,CAAS;AAC5BE,YAAAA,MAAAA,CAAOC,IAAI,CAAC;AAAEX,gBAAAA,IAAAA;AAAMC,gBAAAA;AAAO,aAAA,CAAA;AAC7B,QAAA;AACF,IAAA;IACA,OAAOS,MAAAA;AACT,CAAA;AAEA;;;;;IAMO,MAAME,cAAAA,GAAiB,CAACb,IAAAA,GAAAA;AAC7B,IAAA,IAAIc,MAAAA,GAAS,IAAA;AACb,IAAA,MAAMC,WAAAA,GAAcX,QAAAA,CAASC,MAAM,CAACW,KAAK,CAAC,GAAA,CAAA;IAC1CD,WAAAA,CAAYE,OAAO,CAAC,CAACZ,MAAAA,GAAAA;AACnB,QAAA,MAAM,CAACa,GAAAA,EAAKC,KAAAA,CAAM,GAAGd,MAAAA,CAAOW,KAAK,CAAC,GAAA,CAAA,CAAKI,GAAG,CAAC,CAACC,IAAAA,GAASA,KAAKC,IAAI,EAAA,CAAA;AAC9D,QAAA,IAAIJ,QAAQlB,IAAAA,EAAM;AAChBc,YAAAA,MAAAA,GAASS,kBAAAA,CAAmBJ,KAAAA,CAAAA;AAC9B,QAAA;AACF,IAAA,CAAA,CAAA;IACA,OAAOL,MAAAA;AACT;AAEA;;;;;;;;;;AAUC,IACM,MAAMU,SAAAA,GAAY,CAACxB,MAAcmB,KAAAA,EAAeM,IAAAA,GAAAA;AACrD,IAAA,IAAIC,OAAAA,GAAU,EAAA;;;;;AAWd,IAAA,KAAK,MAAM,EAAEzB,IAAI,EAAEC,MAAM,EAAE,IAAII,eAAAA,EAAAA,CAAmB;QAChD,IAAIL,IAAAA,KAAST,gBAAAA,IAAoBU,MAAAA,KAAWP,kBAAAA,EAAoB;AAC9DI,YAAAA,cAAAA,CAAeC,MAAMC,IAAAA,EAAMC,MAAAA,CAAAA;AAC7B,QAAA;AACF,IAAA;AAEA,IAAA,MAAMC,aAAaR,kBAAAA,GAAqB,CAAC,SAAS,EAAEA,oBAAoB,GAAG,EAAA;;;;;;;;AAQ3E,IAAA,MAAMgC,aAAaC,MAAAA,CAAOC,QAAQ,CAACC,QAAQ,KAAK,WAAW,UAAA,GAAa,EAAA;AACxE1B,IAAAA,QAAAA,CAASC,MAAM,GAAG,CAAA,EAAGL,IAAAA,CAAK,CAAC,EAAE+B,kBAAAA,CAAmBZ,KAAAA,CAAAA,CAAO,OAAO,EAAE3B,gBAAAA,CAAAA,EAAmBW,UAAAA,CAAAA,EAAauB,UAAUC,UAAAA,CAAAA,CAAY;AACxH;AAEA;;;;;;;;;;IAWO,MAAMK,YAAAA,GAAe,CAAChC,IAAAA,GAAAA;AAC3B,IAAA,KAAK,MAAM,EAAEC,IAAI,EAAEC,MAAM,EAAE,IAAII,eAAAA,EAAAA,CAAmB;AAChDP,QAAAA,cAAAA,CAAeC,MAAMC,IAAAA,EAAMC,MAAAA,CAAAA;AAC7B,IAAA;AACF;;;;"}

package/dist/admin/shared/utils/auth-cookie-domain.js

@@ -0,0 +1,41 @@
+'use strict';
+
+/**
+ * Domain attribute of the admin auth (access) token cookie, configurable
+ * through `admin.auth.cookie.domain` (falling back to `admin.auth.domain`) so
+ * multiple Strapi instances under the same parent domain share, or stay
+ * isolated to, the intended host.
+ *
+ * Browser-safe single source for both sides of the handoff: the admin panel
+ * cannot read server config, so the build transports the config value into
+ * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN` variable
+ * (see create-build-context.ts in @strapi/strapi); the server resolves the
+ * same config at runtime. Changing the domain requires an admin rebuild, like
+ * any other admin config change.
+ *
+ * Defaults to `undefined` (host-only cookie) to match the browser default and
+ * the refresh-cookie behaviour in `getRefreshCookieOptions` when no domain is
+ * configured. A host-only cookie and a `Domain`-scoped cookie are distinct
+ * entries in the browser cookie store, so set and delete must agree on the
+ * domain or logout leaves a colliding copy behind.
+ */ const DEFAULT_AUTH_COOKIE_DOMAIN = undefined;
+const isValidCookieDomain = (domain)=>{
+    // RFC 6265 domain-av: a host name. No leading dot required, no scheme, no
+    // path, no port, and none of the control/attribute-separator characters.
+    return !/[\x00-\x1F\x7F;,\s/:]/.test(domain);
+};
+const resolveAuthCookieDomain = (configuredDomain, warn = console.warn)=>{
+    const cookieDomain = (configuredDomain || '').trim();
+    if (!cookieDomain) {
+        return DEFAULT_AUTH_COOKIE_DOMAIN;
+    }
+    if (!isValidCookieDomain(cookieDomain)) {
+        warn(`Ignoring invalid admin auth cookie domain "${cookieDomain}" (must be a bare host name); using a host-only cookie instead.`);
+        return DEFAULT_AUTH_COOKIE_DOMAIN;
+    }
+    return cookieDomain;
+};
+
+exports.DEFAULT_AUTH_COOKIE_DOMAIN = DEFAULT_AUTH_COOKIE_DOMAIN;
+exports.resolveAuthCookieDomain = resolveAuthCookieDomain;
+//# sourceMappingURL=auth-cookie-domain.js.map

package/dist/admin/shared/utils/auth-cookie-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-domain.js","sources":["../../../../shared/utils/auth-cookie-domain.ts"],"sourcesContent":["/**\n * Domain attribute of the admin auth (access) token cookie, configurable\n * through `admin.auth.cookie.domain` (falling back to `admin.auth.domain`) so\n * multiple Strapi instances under the same parent domain share, or stay\n * isolated to, the intended host.\n *\n * Browser-safe single source for both sides of the handoff: the admin panel\n * cannot read server config, so the build transports the config value into\n * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN` variable\n * (see create-build-context.ts in @strapi/strapi); the server resolves the\n * same config at runtime. Changing the domain requires an admin rebuild, like\n * any other admin config change.\n *\n * Defaults to `undefined` (host-only cookie) to match the browser default and\n * the refresh-cookie behaviour in `getRefreshCookieOptions` when no domain is\n * configured. A host-only cookie and a `Domain`-scoped cookie are distinct\n * entries in the browser cookie store, so set and delete must agree on the\n * domain or logout leaves a colliding copy behind.\n */\nexport const DEFAULT_AUTH_COOKIE_DOMAIN = undefined;\n\nconst isValidCookieDomain = (domain: string): boolean => {\n  // RFC 6265 domain-av: a host name. No leading dot required, no scheme, no\n  // path, no port, and none of the control/attribute-separator characters.\n  return !/[\\x00-\\x1F\\x7F;,\\s/:]/.test(domain);\n};\n\nexport const resolveAuthCookieDomain = (\n  configuredDomain?: string,\n  warn: (message: string) => void = console.warn\n): string | undefined => {\n  const cookieDomain = (configuredDomain || '').trim();\n\n  if (!cookieDomain) {\n    return DEFAULT_AUTH_COOKIE_DOMAIN;\n  }\n\n  if (!isValidCookieDomain(cookieDomain)) {\n    warn(\n      `Ignoring invalid admin auth cookie domain \"${cookieDomain}\" (must be a bare host name); using a host-only cookie instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_DOMAIN;\n  }\n\n  return cookieDomain;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_DOMAIN","undefined","isValidCookieDomain","domain","test","resolveAuthCookieDomain","configuredDomain","warn","console","cookieDomain","trim"],"mappings":";;AAAA;;;;;;;;;;;;;;;;;;IAmBO,MAAMA,0BAAAA,GAA6BC;AAE1C,MAAMC,sBAAsB,CAACC,MAAAA,GAAAA;;;IAG3B,OAAO,CAAC,uBAAA,CAAwBC,IAAI,CAACD,MAAAA,CAAAA;AACvC,CAAA;MAEaE,uBAAAA,GAA0B,CACrCC,gBAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,eAAe,CAACH,gBAAAA,IAAoB,EAAC,EAAGI,IAAI,EAAA;AAElD,IAAA,IAAI,CAACD,YAAAA,EAAc;QACjB,OAAOT,0BAAAA;AACT,IAAA;IAEA,IAAI,CAACE,oBAAoBO,YAAAA,CAAAA,EAAe;AACtCF,QAAAA,IAAAA,CACE,CAAC,2CAA2C,EAAEE,YAAAA,CAAa,+DAA+D,CAAC,CAAA;QAE7H,OAAOT,0BAAAA;AACT,IAAA;IAEA,OAAOS,YAAAA;AACT;;;;;"}

package/dist/admin/shared/utils/auth-cookie-domain.mjs

@@ -0,0 +1,38 @@
+/**
+ * Domain attribute of the admin auth (access) token cookie, configurable
+ * through `admin.auth.cookie.domain` (falling back to `admin.auth.domain`) so
+ * multiple Strapi instances under the same parent domain share, or stay
+ * isolated to, the intended host.
+ *
+ * Browser-safe single source for both sides of the handoff: the admin panel
+ * cannot read server config, so the build transports the config value into
+ * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN` variable
+ * (see create-build-context.ts in @strapi/strapi); the server resolves the
+ * same config at runtime. Changing the domain requires an admin rebuild, like
+ * any other admin config change.
+ *
+ * Defaults to `undefined` (host-only cookie) to match the browser default and
+ * the refresh-cookie behaviour in `getRefreshCookieOptions` when no domain is
+ * configured. A host-only cookie and a `Domain`-scoped cookie are distinct
+ * entries in the browser cookie store, so set and delete must agree on the
+ * domain or logout leaves a colliding copy behind.
+ */ const DEFAULT_AUTH_COOKIE_DOMAIN = undefined;
+const isValidCookieDomain = (domain)=>{
+    // RFC 6265 domain-av: a host name. No leading dot required, no scheme, no
+    // path, no port, and none of the control/attribute-separator characters.
+    return !/[\x00-\x1F\x7F;,\s/:]/.test(domain);
+};
+const resolveAuthCookieDomain = (configuredDomain, warn = console.warn)=>{
+    const cookieDomain = (configuredDomain || '').trim();
+    if (!cookieDomain) {
+        return DEFAULT_AUTH_COOKIE_DOMAIN;
+    }
+    if (!isValidCookieDomain(cookieDomain)) {
+        warn(`Ignoring invalid admin auth cookie domain "${cookieDomain}" (must be a bare host name); using a host-only cookie instead.`);
+        return DEFAULT_AUTH_COOKIE_DOMAIN;
+    }
+    return cookieDomain;
+};
+
+export { DEFAULT_AUTH_COOKIE_DOMAIN, resolveAuthCookieDomain };
+//# sourceMappingURL=auth-cookie-domain.mjs.map

package/dist/admin/shared/utils/auth-cookie-domain.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-domain.mjs","sources":["../../../../shared/utils/auth-cookie-domain.ts"],"sourcesContent":["/**\n * Domain attribute of the admin auth (access) token cookie, configurable\n * through `admin.auth.cookie.domain` (falling back to `admin.auth.domain`) so\n * multiple Strapi instances under the same parent domain share, or stay\n * isolated to, the intended host.\n *\n * Browser-safe single source for both sides of the handoff: the admin panel\n * cannot read server config, so the build transports the config value into\n * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN` variable\n * (see create-build-context.ts in @strapi/strapi); the server resolves the\n * same config at runtime. Changing the domain requires an admin rebuild, like\n * any other admin config change.\n *\n * Defaults to `undefined` (host-only cookie) to match the browser default and\n * the refresh-cookie behaviour in `getRefreshCookieOptions` when no domain is\n * configured. A host-only cookie and a `Domain`-scoped cookie are distinct\n * entries in the browser cookie store, so set and delete must agree on the\n * domain or logout leaves a colliding copy behind.\n */\nexport const DEFAULT_AUTH_COOKIE_DOMAIN = undefined;\n\nconst isValidCookieDomain = (domain: string): boolean => {\n  // RFC 6265 domain-av: a host name. No leading dot required, no scheme, no\n  // path, no port, and none of the control/attribute-separator characters.\n  return !/[\\x00-\\x1F\\x7F;,\\s/:]/.test(domain);\n};\n\nexport const resolveAuthCookieDomain = (\n  configuredDomain?: string,\n  warn: (message: string) => void = console.warn\n): string | undefined => {\n  const cookieDomain = (configuredDomain || '').trim();\n\n  if (!cookieDomain) {\n    return DEFAULT_AUTH_COOKIE_DOMAIN;\n  }\n\n  if (!isValidCookieDomain(cookieDomain)) {\n    warn(\n      `Ignoring invalid admin auth cookie domain \"${cookieDomain}\" (must be a bare host name); using a host-only cookie instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_DOMAIN;\n  }\n\n  return cookieDomain;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_DOMAIN","undefined","isValidCookieDomain","domain","test","resolveAuthCookieDomain","configuredDomain","warn","console","cookieDomain","trim"],"mappings":"AAAA;;;;;;;;;;;;;;;;;;IAmBO,MAAMA,0BAAAA,GAA6BC;AAE1C,MAAMC,sBAAsB,CAACC,MAAAA,GAAAA;;;IAG3B,OAAO,CAAC,uBAAA,CAAwBC,IAAI,CAACD,MAAAA,CAAAA;AACvC,CAAA;MAEaE,uBAAAA,GAA0B,CACrCC,gBAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,eAAe,CAACH,gBAAAA,IAAoB,EAAC,EAAGI,IAAI,EAAA;AAElD,IAAA,IAAI,CAACD,YAAAA,EAAc;QACjB,OAAOT,0BAAAA;AACT,IAAA;IAEA,IAAI,CAACE,oBAAoBO,YAAAA,CAAAA,EAAe;AACtCF,QAAAA,IAAAA,CACE,CAAC,2CAA2C,EAAEE,YAAAA,CAAa,+DAA+D,CAAC,CAAA;QAE7H,OAAOT,0BAAAA;AACT,IAAA;IAEA,OAAOS,YAAAA;AACT;;;;"}

package/dist/admin/shared/utils/auth-cookie-name.js

@@ -14,13 +14,13 @@
  */ const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';
 // RFC 6265 cookie-name token characters.
 const VALID_COOKIE_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-const resolveAuthCookieName = (configuredName)=>{
+const resolveAuthCookieName = (configuredName, warn = console.warn)=>{
     const cookieName = (configuredName || '').trim();
     if (!cookieName) {
         return DEFAULT_AUTH_COOKIE_NAME;
     }
     if (!VALID_COOKIE_NAME.test(cookieName)) {
-        console.warn(`Ignoring invalid admin auth cookie name "${cookieName}" (must only contain RFC 6265 cookie-name characters); using "${DEFAULT_AUTH_COOKIE_NAME}" instead.`);
+        warn(`Ignoring invalid admin auth cookie name "${cookieName}" (must only contain RFC 6265 cookie-name characters); using "${DEFAULT_AUTH_COOKIE_NAME}" instead.`);
         return DEFAULT_AUTH_COOKIE_NAME;
     }
     return cookieName;

package/dist/admin/shared/utils/auth-cookie-name.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cookie-name.js","sources":["../../../../shared/utils/auth-cookie-name.ts"],"sourcesContent":["/**\n * Name of the cookie holding the admin auth (access) token, configurable\n * through `admin.auth.cookie.name` so it cannot collide with a same-named\n * cookie set by another application on a shared parent domain.\n *\n * Browser-safe single source for both sides of the SSO handoff: the admin\n * panel cannot read server config, so the build transports the config value\n * into the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_NAME`\n * variable (see create-build-context.ts in @strapi/strapi); the server\n * resolves the same config at runtime. Renaming the cookie requires an admin\n * rebuild, like any other admin config change.\n */\nexport const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';\n\n// RFC 6265 cookie-name token characters.\nconst VALID_COOKIE_NAME = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\n\nexport const resolveAuthCookieName = (configuredName?: string): string => {\n  const cookieName = (configuredName || '').trim();\n\n  if (!cookieName) {\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  if (!VALID_COOKIE_NAME.test(cookieName)) {\n    console.warn(\n      `Ignoring invalid admin auth cookie name \"${cookieName}\" (must only contain RFC 6265 cookie-name characters); using \"${DEFAULT_AUTH_COOKIE_NAME}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  return cookieName;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_NAME","VALID_COOKIE_NAME","resolveAuthCookieName","configuredName","cookieName","trim","test","console","warn"],"mappings":";;AAAA;;;;;;;;;;;IAYO,MAAMA,wBAAAA,GAA2B;AAExC;AACA,MAAMC,iBAAAA,GAAoB,gCAAA;AAEnB,MAAMC,wBAAwB,CAACC,cAAAA,GAAAA;AACpC,IAAA,MAAMC,aAAa,CAACD,cAAAA,IAAkB,EAAC,EAAGE,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAOJ,wBAAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACC,iBAAAA,CAAkBK,IAAI,CAACF,UAAAA,CAAAA,EAAa;QACvCG,OAAAA,CAAQC,IAAI,CACV,CAAC,yCAAyC,EAAEJ,WAAW,8DAA8D,EAAEJ,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAE7J,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOI,UAAAA;AACT;;;;;"}
+{"version":3,"file":"auth-cookie-name.js","sources":["../../../../shared/utils/auth-cookie-name.ts"],"sourcesContent":["/**\n * Name of the cookie holding the admin auth (access) token, configurable\n * through `admin.auth.cookie.name` so it cannot collide with a same-named\n * cookie set by another application on a shared parent domain.\n *\n * Browser-safe single source for both sides of the SSO handoff: the admin\n * panel cannot read server config, so the build transports the config value\n * into the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_NAME`\n * variable (see create-build-context.ts in @strapi/strapi); the server\n * resolves the same config at runtime. Renaming the cookie requires an admin\n * rebuild, like any other admin config change.\n */\nexport const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';\n\n// RFC 6265 cookie-name token characters.\nconst VALID_COOKIE_NAME = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\n\nexport const resolveAuthCookieName = (\n  configuredName?: string,\n  warn: (message: string) => void = console.warn\n): string => {\n  const cookieName = (configuredName || '').trim();\n\n  if (!cookieName) {\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  if (!VALID_COOKIE_NAME.test(cookieName)) {\n    warn(\n      `Ignoring invalid admin auth cookie name \"${cookieName}\" (must only contain RFC 6265 cookie-name characters); using \"${DEFAULT_AUTH_COOKIE_NAME}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  return cookieName;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_NAME","VALID_COOKIE_NAME","resolveAuthCookieName","configuredName","warn","console","cookieName","trim","test"],"mappings":";;AAAA;;;;;;;;;;;IAYO,MAAMA,wBAAAA,GAA2B;AAExC;AACA,MAAMC,iBAAAA,GAAoB,gCAAA;MAEbC,qBAAAA,GAAwB,CACnCC,cAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,aAAa,CAACH,cAAAA,IAAkB,EAAC,EAAGI,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAON,wBAAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACC,iBAAAA,CAAkBO,IAAI,CAACF,UAAAA,CAAAA,EAAa;QACvCF,IAAAA,CACE,CAAC,yCAAyC,EAAEE,UAAAA,CAAW,8DAA8D,EAAEN,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAE7J,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOM,UAAAA;AACT;;;;;"}

package/dist/admin/shared/utils/auth-cookie-name.mjs

@@ -12,13 +12,13 @@
  */ const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';
 // RFC 6265 cookie-name token characters.
 const VALID_COOKIE_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-const resolveAuthCookieName = (configuredName)=>{
+const resolveAuthCookieName = (configuredName, warn = console.warn)=>{
     const cookieName = (configuredName || '').trim();
     if (!cookieName) {
         return DEFAULT_AUTH_COOKIE_NAME;
     }
     if (!VALID_COOKIE_NAME.test(cookieName)) {
-        console.warn(`Ignoring invalid admin auth cookie name "${cookieName}" (must only contain RFC 6265 cookie-name characters); using "${DEFAULT_AUTH_COOKIE_NAME}" instead.`);
+        warn(`Ignoring invalid admin auth cookie name "${cookieName}" (must only contain RFC 6265 cookie-name characters); using "${DEFAULT_AUTH_COOKIE_NAME}" instead.`);
         return DEFAULT_AUTH_COOKIE_NAME;
     }
     return cookieName;

package/dist/admin/shared/utils/auth-cookie-name.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cookie-name.mjs","sources":["../../../../shared/utils/auth-cookie-name.ts"],"sourcesContent":["/**\n * Name of the cookie holding the admin auth (access) token, configurable\n * through `admin.auth.cookie.name` so it cannot collide with a same-named\n * cookie set by another application on a shared parent domain.\n *\n * Browser-safe single source for both sides of the SSO handoff: the admin\n * panel cannot read server config, so the build transports the config value\n * into the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_NAME`\n * variable (see create-build-context.ts in @strapi/strapi); the server\n * resolves the same config at runtime. Renaming the cookie requires an admin\n * rebuild, like any other admin config change.\n */\nexport const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';\n\n// RFC 6265 cookie-name token characters.\nconst VALID_COOKIE_NAME = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\n\nexport const resolveAuthCookieName = (configuredName?: string): string => {\n  const cookieName = (configuredName || '').trim();\n\n  if (!cookieName) {\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  if (!VALID_COOKIE_NAME.test(cookieName)) {\n    console.warn(\n      `Ignoring invalid admin auth cookie name \"${cookieName}\" (must only contain RFC 6265 cookie-name characters); using \"${DEFAULT_AUTH_COOKIE_NAME}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  return cookieName;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_NAME","VALID_COOKIE_NAME","resolveAuthCookieName","configuredName","cookieName","trim","test","console","warn"],"mappings":"AAAA;;;;;;;;;;;IAYO,MAAMA,wBAAAA,GAA2B;AAExC;AACA,MAAMC,iBAAAA,GAAoB,gCAAA;AAEnB,MAAMC,wBAAwB,CAACC,cAAAA,GAAAA;AACpC,IAAA,MAAMC,aAAa,CAACD,cAAAA,IAAkB,EAAC,EAAGE,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAOJ,wBAAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACC,iBAAAA,CAAkBK,IAAI,CAACF,UAAAA,CAAAA,EAAa;QACvCG,OAAAA,CAAQC,IAAI,CACV,CAAC,yCAAyC,EAAEJ,WAAW,8DAA8D,EAAEJ,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAE7J,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOI,UAAAA;AACT;;;;"}
+{"version":3,"file":"auth-cookie-name.mjs","sources":["../../../../shared/utils/auth-cookie-name.ts"],"sourcesContent":["/**\n * Name of the cookie holding the admin auth (access) token, configurable\n * through `admin.auth.cookie.name` so it cannot collide with a same-named\n * cookie set by another application on a shared parent domain.\n *\n * Browser-safe single source for both sides of the SSO handoff: the admin\n * panel cannot read server config, so the build transports the config value\n * into the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_NAME`\n * variable (see create-build-context.ts in @strapi/strapi); the server\n * resolves the same config at runtime. Renaming the cookie requires an admin\n * rebuild, like any other admin config change.\n */\nexport const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';\n\n// RFC 6265 cookie-name token characters.\nconst VALID_COOKIE_NAME = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\n\nexport const resolveAuthCookieName = (\n  configuredName?: string,\n  warn: (message: string) => void = console.warn\n): string => {\n  const cookieName = (configuredName || '').trim();\n\n  if (!cookieName) {\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  if (!VALID_COOKIE_NAME.test(cookieName)) {\n    warn(\n      `Ignoring invalid admin auth cookie name \"${cookieName}\" (must only contain RFC 6265 cookie-name characters); using \"${DEFAULT_AUTH_COOKIE_NAME}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  return cookieName;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_NAME","VALID_COOKIE_NAME","resolveAuthCookieName","configuredName","warn","console","cookieName","trim","test"],"mappings":"AAAA;;;;;;;;;;;IAYO,MAAMA,wBAAAA,GAA2B;AAExC;AACA,MAAMC,iBAAAA,GAAoB,gCAAA;MAEbC,qBAAAA,GAAwB,CACnCC,cAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,aAAa,CAACH,cAAAA,IAAkB,EAAC,EAAGI,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAON,wBAAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACC,iBAAAA,CAAkBO,IAAI,CAACF,UAAAA,CAAAA,EAAa;QACvCF,IAAAA,CACE,CAAC,yCAAyC,EAAEE,UAAAA,CAAW,8DAA8D,EAAEN,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAE7J,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOM,UAAAA;AACT;;;;"}

package/dist/admin/shared/utils/auth-cookie-path.js

@@ -0,0 +1,39 @@
+'use strict';
+
+/**
+ * Path attribute of the admin auth (access) token cookie, configurable
+ * through `admin.auth.cookie.path` so multiple Strapi instances on the same
+ * parent domain can keep separate cookies (e.g. `/strapi-de/admin`).
+ *
+ * Browser-safe single source for both sides of the handoff: the admin panel
+ * cannot read server config, so the build transports the config value into
+ * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH` variable
+ * (see create-build-context.ts in @strapi/strapi); the server resolves the
+ * same config at runtime. Changing the path requires an admin rebuild, like
+ * any other admin config change.
+ *
+ * Defaults to `/admin` to match the refresh-cookie path used by
+ * `getRefreshCookieOptions`.
+ */ const DEFAULT_AUTH_COOKIE_PATH = '/admin';
+const isValidCookiePath = (path)=>{
+    if (!path.startsWith('/')) {
+        return false;
+    }
+    // RFC 6265 path-av: any CHAR except CTLs or ";".
+    return !/[\x00-\x1F\x7F;]/.test(path);
+};
+const resolveAuthCookiePath = (configuredPath, warn = console.warn)=>{
+    const cookiePath = (configuredPath || '').trim();
+    if (!cookiePath) {
+        return DEFAULT_AUTH_COOKIE_PATH;
+    }
+    if (!isValidCookiePath(cookiePath)) {
+        warn(`Ignoring invalid admin auth cookie path "${cookiePath}" (must be an absolute path without ";"); using "${DEFAULT_AUTH_COOKIE_PATH}" instead.`);
+        return DEFAULT_AUTH_COOKIE_PATH;
+    }
+    return cookiePath;
+};
+
+exports.DEFAULT_AUTH_COOKIE_PATH = DEFAULT_AUTH_COOKIE_PATH;
+exports.resolveAuthCookiePath = resolveAuthCookiePath;
+//# sourceMappingURL=auth-cookie-path.js.map

package/dist/admin/shared/utils/auth-cookie-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-path.js","sources":["../../../../shared/utils/auth-cookie-path.ts"],"sourcesContent":["/**\n * Path attribute of the admin auth (access) token cookie, configurable\n * through `admin.auth.cookie.path` so multiple Strapi instances on the same\n * parent domain can keep separate cookies (e.g. `/strapi-de/admin`).\n *\n * Browser-safe single source for both sides of the handoff: the admin panel\n * cannot read server config, so the build transports the config value into\n * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH` variable\n * (see create-build-context.ts in @strapi/strapi); the server resolves the\n * same config at runtime. Changing the path requires an admin rebuild, like\n * any other admin config change.\n *\n * Defaults to `/admin` to match the refresh-cookie path used by\n * `getRefreshCookieOptions`.\n */\nexport const DEFAULT_AUTH_COOKIE_PATH = '/admin';\n\nconst isValidCookiePath = (path: string): boolean => {\n  if (!path.startsWith('/')) {\n    return false;\n  }\n\n  // RFC 6265 path-av: any CHAR except CTLs or \";\".\n  return !/[\\x00-\\x1F\\x7F;]/.test(path);\n};\n\nexport const resolveAuthCookiePath = (\n  configuredPath?: string,\n  warn: (message: string) => void = console.warn\n): string => {\n  const cookiePath = (configuredPath || '').trim();\n\n  if (!cookiePath) {\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  if (!isValidCookiePath(cookiePath)) {\n    warn(\n      `Ignoring invalid admin auth cookie path \"${cookiePath}\" (must be an absolute path without \";\"); using \"${DEFAULT_AUTH_COOKIE_PATH}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  return cookiePath;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_PATH","isValidCookiePath","path","startsWith","test","resolveAuthCookiePath","configuredPath","warn","console","cookiePath","trim"],"mappings":";;AAAA;;;;;;;;;;;;;;IAeO,MAAMA,wBAAAA,GAA2B;AAExC,MAAMC,oBAAoB,CAACC,IAAAA,GAAAA;AACzB,IAAA,IAAI,CAACA,IAAAA,CAAKC,UAAU,CAAC,GAAA,CAAA,EAAM;QACzB,OAAO,KAAA;AACT,IAAA;;IAGA,OAAO,CAAC,kBAAA,CAAmBC,IAAI,CAACF,IAAAA,CAAAA;AAClC,CAAA;MAEaG,qBAAAA,GAAwB,CACnCC,cAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,aAAa,CAACH,cAAAA,IAAkB,EAAC,EAAGI,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAOT,wBAAAA;AACT,IAAA;IAEA,IAAI,CAACC,kBAAkBQ,UAAAA,CAAAA,EAAa;QAClCF,IAAAA,CACE,CAAC,yCAAyC,EAAEE,UAAAA,CAAW,iDAAiD,EAAET,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAEhJ,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOS,UAAAA;AACT;;;;;"}

package/dist/admin/shared/utils/auth-cookie-path.mjs

@@ -0,0 +1,36 @@
+/**
+ * Path attribute of the admin auth (access) token cookie, configurable
+ * through `admin.auth.cookie.path` so multiple Strapi instances on the same
+ * parent domain can keep separate cookies (e.g. `/strapi-de/admin`).
+ *
+ * Browser-safe single source for both sides of the handoff: the admin panel
+ * cannot read server config, so the build transports the config value into
+ * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH` variable
+ * (see create-build-context.ts in @strapi/strapi); the server resolves the
+ * same config at runtime. Changing the path requires an admin rebuild, like
+ * any other admin config change.
+ *
+ * Defaults to `/admin` to match the refresh-cookie path used by
+ * `getRefreshCookieOptions`.
+ */ const DEFAULT_AUTH_COOKIE_PATH = '/admin';
+const isValidCookiePath = (path)=>{
+    if (!path.startsWith('/')) {
+        return false;
+    }
+    // RFC 6265 path-av: any CHAR except CTLs or ";".
+    return !/[\x00-\x1F\x7F;]/.test(path);
+};
+const resolveAuthCookiePath = (configuredPath, warn = console.warn)=>{
+    const cookiePath = (configuredPath || '').trim();
+    if (!cookiePath) {
+        return DEFAULT_AUTH_COOKIE_PATH;
+    }
+    if (!isValidCookiePath(cookiePath)) {
+        warn(`Ignoring invalid admin auth cookie path "${cookiePath}" (must be an absolute path without ";"); using "${DEFAULT_AUTH_COOKIE_PATH}" instead.`);
+        return DEFAULT_AUTH_COOKIE_PATH;
+    }
+    return cookiePath;
+};
+
+export { DEFAULT_AUTH_COOKIE_PATH, resolveAuthCookiePath };
+//# sourceMappingURL=auth-cookie-path.mjs.map

package/dist/admin/shared/utils/auth-cookie-path.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-path.mjs","sources":["../../../../shared/utils/auth-cookie-path.ts"],"sourcesContent":["/**\n * Path attribute of the admin auth (access) token cookie, configurable\n * through `admin.auth.cookie.path` so multiple Strapi instances on the same\n * parent domain can keep separate cookies (e.g. `/strapi-de/admin`).\n *\n * Browser-safe single source for both sides of the handoff: the admin panel\n * cannot read server config, so the build transports the config value into\n * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH` variable\n * (see create-build-context.ts in @strapi/strapi); the server resolves the\n * same config at runtime. Changing the path requires an admin rebuild, like\n * any other admin config change.\n *\n * Defaults to `/admin` to match the refresh-cookie path used by\n * `getRefreshCookieOptions`.\n */\nexport const DEFAULT_AUTH_COOKIE_PATH = '/admin';\n\nconst isValidCookiePath = (path: string): boolean => {\n  if (!path.startsWith('/')) {\n    return false;\n  }\n\n  // RFC 6265 path-av: any CHAR except CTLs or \";\".\n  return !/[\\x00-\\x1F\\x7F;]/.test(path);\n};\n\nexport const resolveAuthCookiePath = (\n  configuredPath?: string,\n  warn: (message: string) => void = console.warn\n): string => {\n  const cookiePath = (configuredPath || '').trim();\n\n  if (!cookiePath) {\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  if (!isValidCookiePath(cookiePath)) {\n    warn(\n      `Ignoring invalid admin auth cookie path \"${cookiePath}\" (must be an absolute path without \";\"); using \"${DEFAULT_AUTH_COOKIE_PATH}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  return cookiePath;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_PATH","isValidCookiePath","path","startsWith","test","resolveAuthCookiePath","configuredPath","warn","console","cookiePath","trim"],"mappings":"AAAA;;;;;;;;;;;;;;IAeO,MAAMA,wBAAAA,GAA2B;AAExC,MAAMC,oBAAoB,CAACC,IAAAA,GAAAA;AACzB,IAAA,IAAI,CAACA,IAAAA,CAAKC,UAAU,CAAC,GAAA,CAAA,EAAM;QACzB,OAAO,KAAA;AACT,IAAA;;IAGA,OAAO,CAAC,kBAAA,CAAmBC,IAAI,CAACF,IAAAA,CAAAA;AAClC,CAAA;MAEaG,qBAAAA,GAAwB,CACnCC,cAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,aAAa,CAACH,cAAAA,IAAkB,EAAC,EAAGI,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAOT,wBAAAA;AACT,IAAA;IAEA,IAAI,CAACC,kBAAkBQ,UAAAA,CAAAA,EAAa;QAClCF,IAAAA,CACE,CAAC,yCAAyC,EAAEE,UAAAA,CAAW,iDAAiD,EAAET,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAEhJ,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOS,UAAAA;AACT;;;;"}

package/dist/admin/src/utils/cookies.d.ts

@@ -3,6 +3,17 @@
  * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_NAME`.
  */
 export declare const AUTH_COOKIE_NAME: string;
+/**
+ * Resolved once at module load: the build inlines `admin.auth.cookie.path`
+ * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_PATH`.
+ */
+export declare const AUTH_COOKIE_PATH: string;
+/**
+ * Resolved once at module load: the build inlines `admin.auth.cookie.domain`
+ * into the bundle as `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN`. `undefined` means the
+ * cookie is host-only.
+ */
+export declare const AUTH_COOKIE_DOMAIN: string | undefined;
 /**
  * Retrieves the value of a specified cookie.
  *
@@ -12,6 +23,10 @@ export declare const AUTH_COOKIE_NAME: string;
 export declare const getCookieValue: (name: string) => string | null;
 /**
  * Sets a cookie with the given name, value, and optional expiration time.
+ * Uses `admin.auth.cookie.path` and `admin.auth.cookie.domain` (both inlined
+ * at build time) so the access cookie stays scoped to the same path and domain
+ * as the httpOnly refresh cookie and the EE SSO access cookie. The cookie is
+ * marked `Secure` whenever the page is served over TLS.
  *
  * @param name - The name of the cookie.
  * @param value - The value of the cookie.
@@ -21,6 +36,12 @@ export declare const setCookie: (name: string, value: string, days?: number) =>
 /**
  * Deletes a cookie by setting its expiration date to a past date.
  *
+ * Expires every combination of {configured path, legacy Path=/} and
+ * {configured domain, host-only}. A `Domain`-scoped cookie is a distinct entry
+ * from a host-only one in the browser cookie store, so both must be cleared or
+ * remote logout leaves the EE SSO cookie (written with `Domain` by the server)
+ * behind, rehydrating a dead session into an infinite login redirect.
+ *
  * @param name - The name of the cookie to delete.
  */
 export declare const deleteCookie: (name: string) => void;

package/dist/ee/server/src/controllers/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../../ee/server/src/controllers/admin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,wBAoEE"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../../ee/server/src/controllers/admin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,wBAoEE"}

package/dist/ee/server/src/controllers/authentication-utils/middlewares.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAc1C,eAAO,MAAM,YAAY,EAAE,IAAI,CAAC,iBA0B/B,CAAC;AA4DF,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,iBA0DnC,CAAC;;;;;AAEF,wBAGE"}
+{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAiB1C,eAAO,MAAM,YAAY,EAAE,IAAI,CAAC,iBA0B/B,CAAC;AA4DF,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,iBAiEnC,CAAC;;;;;AAEF,wBAGE"}

package/dist/ee/server/src/services/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../ee/server/src/services/auth.ts"],"names":[],"mappings":";iCAayC,GAAG;uDAyCmB,GAAG;;AAelE,wBAGE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../ee/server/src/services/auth.ts"],"names":[],"mappings":";iCAiByC,GAAG;uDAwCmB,GAAG;;AAkBlE,wBAGE"}

package/dist/ee/server/src/services/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../../ee/server/src/services/user.ts"],"names":[],"mappings":";oCAmB6C,MAAM,SAAS,GAAG;yCAwBb,OAAO;;uBA8HzB,GAAG;qBAzCL,OAAO;qBAzDP,GAAG,cAAc,GAAG;;AA4KlD,wBAOE"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../../ee/server/src/services/user.ts"],"names":[],"mappings":";oCAmB6C,MAAM,SAAS,GAAG;yCAwBb,OAAO;;uBA8HzB,GAAG;qBAzCL,OAAO;qBAzDP,GAAG,cAAc,GAAG;;AAkLlD,wBAOE"}