Hi guys, I changed my supertoken cookies (e.g. sFrontToken) to see how supertokens deals with it :-). I get now a  "Failed to execute 'atob' on 'Window'" exception, which is fine as the token is for sure corrupt. How can I programmatically resolve this situation? Calling e.g. Session.signOut() isn't callable as it will also throw the "Failed to execute 'atob' on 'Window'" exception. Any clue? Maybe I miss some callable function within the frontend which can force the deletion of all supertoken cookies. Thanks!

Hi, If this is on the web, you could delete the cookies from the application tab in the dev tools. This will log you out

Yeah I know. But it would be great to have a method to call provided by e.g. "supertokens-web-js" package which knows which cookies should be deleted.

Hmm fair, in the meantime you could delete just the sFrontToken and IRTFrontToken

I got it. But when I wanna do it programatically at the frontend side, like when Session.doesSessionExist() throws an exception it would be good to have a method which can delete all known supertoken cookies!?

Yep unfortunately the frontend relies on the backend SDKs to decide when cookies should be removed (since some of them are httponly cookies). In this case since the token is malformed signOut also ends up throwing an error instead of clearing cookies You could try creating an API on the backend which calls revokeSession and see if that helps? In the meantime we will evaluate adding a helper for this

Thanks a lot! I'll check the revokeSession approach!

Happy to help

FYI: the revokeSession approach doesn't work out of the box, as the session is "only" revoked at the backend side. Sending cookie information like

res.cookie('sFrontToken', '', { maxAge: 0});

is working, but then you have to still know the names of the cookies to destroy. So it would be super useful to have a helper for this! 1000 Upvotes for the helper 🙂

Alright we’ll discuss it and see if we can add it

Hey @DanielAtStruggly revokeSession on the backend would also clear the cookies on the frontend (sFrontToken etc..). That’s how the sign out API works

You are right, calling req.session.revokeSession that results from session verification should do the trick - I missed that. Thanks again helping out.

Awesome.