Sign-out handling
A user signs out and the server needs to invalidate a session cookie in the browser.
Express.js · Module
res.clearCookie
Clears a named cookie by sending a Set-Cookie header with an expiration date in the past. Match the original cookie options, but omit expires and maxAge.
- Since
- 4.20.0 (passing expires and maxAge deprecated)
How it works
Calling this method sends a Set-Cookie response header for the named cookie with an expiration date in the past. Supply cookie options that match the original res.cookie call, except for expires and maxAge, so the browser can identify the cookie to remove.
Syntax
res.clearCookie(name [, options])Parameters
| Name | Type | Description |
|---|---|---|
name | String | The name of the cookie to clear. |
options | Object | undefined | Cookie options matching those supplied to res.cookie(), excluding expires and maxAge. |
Returns
Response
Key points
- The method identifies the target by cookie name and communicates removal through the HTTP response.
- The response marks the cookie as expired rather than deleting browser storage directly.
- Provide the same identifying cookie attributes that were used when the cookie was created.
- The matching options exclude the two lifetime controls named by the documentation.
- Unspecified cookie attributes follow the defaults defined by RFC 6265.
Common mistakes
- Use the same cookie attributes as when setting the cookie; otherwise, a browser may retain it.
- Do not pass maxAge or expires; their use with this method is deprecated in Express 4.20.0.
Example: Clear a session cookie
const express = require('express');
const app = express();
app.get('/logout', (req, res) => {
res.clearCookie('session', { path: '/' });
res.sendStatus(204);
});
app.listen(3000);This route clears the session cookie using the same path used when the cookie was created, then returns a successful empty response.
When to use it
Path-scoped cleanup
A route removes a cookie scoped to a specific path by repeating that path in the clearing call.
Removing obsolete state
An application retires a client-side preference or feature flag cookie.
Interview questions
QHow does res.clearCookie remove a cookie?
It sends a Set-Cookie header whose expiration date is in the past, telling the client that the named cookie has expired. The method returns the response object.
Follow-up: What must match the original cookie? The relevant options, such as path or domain, must be identical, while expires and maxAge should be omitted.
QWhat arguments does res.clearCookie accept?
The name argument identifies the cookie. The optional options object contains cookie settings that should match those used by res.cookie, excluding expires and maxAge.
Follow-up: Why does path matter? Cookies with different paths are distinct from the browser's perspective, so clearing one path does not necessarily remove another.
QHow should a cookie set with a non-default path be cleared?
Use res.cookie and res.clearCookie with the same path or other identifying attributes. For example, a cookie created with path '/admin' should be cleared with path '/admin'.
Follow-up: What changed in Express 4.20.0? Passing expires or maxAge to this method was deprecated because those values can prevent reliable clearing.
Related
res.cookie()Set-CookieRFC 6265