how to revoke Http-only cookies in the browser when logging out in frontend?

Question

how to revoke Http-only cookies in the browser when logging out in frontend?

situations:

1. I set an authentication cookie for logged users on the server.
2. the cookie marked as Http-only to prevent XSS attack.
3. the cookie set 3 months expiration to prevent inputting credential every time.
4. Occasionally, when the user clicked the logout button the network is not working for some unknown reason so the browser keeps that cookie after the user logged out.
5. to prevent this happen, I have to force the browser to revoke cookies after the user clicks the logout button.
6. but the wiki told me that I do not have the permissions to change the Http-only cookies.

So, How can I revoke the Http-only cookie?
Or, am I missed something in session configurations on the server?

Answer 1

There's a workaround:

Whenever a user clicks the logout button set a new, separately named, cookie for the website's domain that indicates to the web-server that the user's HTTP-only cookie should be immediately expired on the next successful HTTP request (e.g. expire-my-session-cookie). Finally, in the server, add a middleware, request-interceptor or HTTP-module (I don't know what server-side platform you're using) that checks for this expire-my-session-cookie) and if present, redirects or rewrites the request to the real logout handler to complete the task of expiring any HTTP-only cookies.

I don't think there's any security risk here as if if your site does have a script-injection vulnerability then a malicious script could unilaterally log-off your users anyway simply by setting window.location = 'http://your/logoff/page'.

Something like this in the rendered HTML:

<a href="/logoff" onclick="document.cookie = 'expire-my-session-cookie=true'; return true;">logoff</a>

Something like this as a HTTP middleware (i.e. executed on every request, except static files and assets):

(Pseudocode)

function( next ) {

    if( request.cookies["expire-my-session-cookie"] == "true" ) {

        // Set all of the user's cookies to expire immediately:
        for( int i = 0; i < request.cookies.length; i++ ) {

            response.cookies.setCookie( request.cookies[i].name, "", expires: 1970-01-01 );
        }

        return response.redirect( 'logoff-handler' );
    }
    else {

        // Otherwise continue as normal:
        return next();
    }