Clear invalid session cookies

[paescuj]

Scope

In some cases tokens can become invalid. For example, if the signing secret has changed since the token was issued, which will especially be the case in dev/test environments after merging #22320.

A client with an invalid token won't be able to perform any requests. This is particularly cumbersome in browsers using the session cookie mode (Data Studio) as the cookie would have to be deleted manually, in order to be able to refresh the session (login) and get a valid token again.

This PR ensures such invalid session cookies are cleared from the client's cookie store. For the Data Studio, this means the login page will be shown instead of a reoccurring error message (for open tabs, a page refresh might be necessary).

Potential Risks / Drawbacks

• This solution feels like the simplest one, but could perhaps present a somewhat unexpected / not that intuitive behavior. That seems negligible to me, as we are dealing with an edge case here respectively a case which is only to be expected in dev/tests environments.
• The affected request will still fail, the clearing of the cookie will only take effect in subsequent requests.

Review Notes / Questions

None

[changeset-bot]

🦋 Changeset detected

Latest commit: 3ae3b1c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@directus/api	Patch
directus	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR