Fix

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

Author: jviotti

enterprise/server/include/sourcemeta/one/enterprise_server_action_auth_callback_v1.h

@@ -315,7 +315,8 @@ class ActionAuthCallback_v1 : public sourcemeta::one::RouterAction {
     this->remember_renewal(response, policy_name, scope, secure);
     // The single-use transaction has served its purpose, so it is expired
     // alongside minting the session
-    this->expire_transaction(response, scope, secure);
+    this->expire(response, sourcemeta::one::Authentication::TRANSACTION_COOKIE,
+                 scope, secure);
     response.write_header("Location", destination);
     response.write_header("Cache-Control", "no-store");
     sourcemeta::one::send_response(sourcemeta::core::HTTP_STATUS_SEE_OTHER,
@@ -495,7 +496,8 @@ class ActionAuthCallback_v1 : public sourcemeta::one::RouterAction {
     response.write_status(sourcemeta::core::HTTP_STATUS_SEE_OTHER);
     this->expire(response, sourcemeta::one::Authentication::RENEWAL_COOKIE,
                  scope, secure);
-    this->expire_transaction(response, scope, secure);
+    this->expire(response, sourcemeta::one::Authentication::TRANSACTION_COOKIE,
+                 scope, secure);
     response.write_header("Location", destination);
     response.write_header("Cache-Control", "no-store");
     sourcemeta::one::send_response(sourcemeta::core::HTTP_STATUS_SEE_OTHER,
@@ -518,22 +520,6 @@ class ActionAuthCallback_v1 : public sourcemeta::one::RouterAction {
     }
   }
 
-  auto expire_transaction(sourcemeta::one::HTTPResponse &response,
-                          const std::string_view scope, const bool secure) const
-      -> void {
-    const auto cookie{sourcemeta::core::http_serialize_cookie(
-        {.name = sourcemeta::one::Authentication::TRANSACTION_COOKIE,
-         .value = "",
-         .path = scope,
-         .max_age = std::chrono::seconds{0},
-         .http_only = true,
-         .secure = secure,
-         .same_site = sourcemeta::core::HTTPCookieSameSite::Lax})};
-    if (cookie.has_value()) {
-      response.write_header("Set-Cookie", cookie.value());
-    }
-  }
-
   // RFC 6749 Section 2.3.1 has every server accept the client secret in an
   // authorization header, and asks that carrying it in the request body be
   // limited to clients that cannot send one. A body is the part of a request