Provide way to invalidate edge bearer token when impersonate or logout - sending/receiving cookies for cross-origin requests EDGE part
@@ -145,12 +145,11 @@ http {
}
location ${CP_EDGE_INVALIDATE_AUTH_PATH} {
+ add_header Access-Control-Allow-Credentials "true";
add_header Access-Control-Allow-Origin ${CP_EDGE_INVALIDATE_URL_CORS};
- add_header Content-Length 0;
- add_header Content-Type text/plain;
add_header Access-Control-Allow-Headers *;
add_header Vary Origin;
- add_header Set-Cookie "bearer=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT";
+ add_header Set-Cookie "bearer=; path=/; SameSite=None; Secure; expires=Thu, 01 Jan 1970 00:00:00 GMT";
return 200;
}
