aec822adc2a01b3bd8c1b2d55a2d2551cd1c6891
clearCookie was missing httpOnly, secure, sameSite — browser ignored the Set-Cookie header because the options didn't match the original cookie attributes. Cookie persisted after logout, allowing F5 to re-authenticate via silent refresh. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Description
No description provided