fix(auth): ensure Keycloak logout clears secure session

src/app/api/auth/keycloak-logout/route.ts

@@ -20,8 +20,6 @@ export const GET = async (request: NextRequest) => {
   );
   const issuer = process.env.KEYCLOAK_ISSUER?.replace(/\/$/, "");
   const clientId = process.env.KEYCLOAK_CLIENT_ID;
-  const postLogoutRedirectUri =
-    process.env.KEYCLOAK_POST_LOGOUT_REDIRECT_URI;
   const token = (await getToken({
     req: request,
     secret: process.env.NEXTAUTH_SECRET,
@@ -33,17 +31,17 @@ export const GET = async (request: NextRequest) => {
   if (issuer) {
     if (clientId) logoutUrl.searchParams.set("client_id", clientId);
     if (token?.idToken) logoutUrl.searchParams.set("id_token_hint", token.idToken);
-    if (postLogoutRedirectUri) {
-      logoutUrl.searchParams.set(
-        "post_logout_redirect_uri",
-        postLogoutRedirectUri,
-      );
-    }
   }
 
   const response = NextResponse.redirect(logoutUrl);
   for (const { name } of request.cookies.getAll()) {
-    if (isSessionCookie(name)) response.cookies.delete(name);
+    if (isSessionCookie(name)) {
+      response.cookies.delete({
+        name,
+        path: "/",
+        secure: name.startsWith("__Secure-"),
+      });
+    }
   }
 
   return response;