Repository: auth0/auth0-spa-js (ts)

Issue:
Legacy SameSite cookie is not cleared on logout
<!--
**Please do not report security vulnerabilities here**. The [Responsible Disclosure Program](https://auth0.com/whitehat) details the procedure for disclosing security issues.

**Thank you in advance for helping us to improve this library!** Please read through the template below and answer all relevant questions. Your additional work here is greatly appreciated and will help us respond as quickly as possible. For general support or usage questions, use the [Auth0 Community](https://community.auth0.com/) or [Auth0 Support](https://support.auth0.com/). Finally, to avoid duplicates, please search existing Issues before submitting one here.

By submitting an Issue to this repository, you agree to the terms within the [Auth0 Code of Conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md).
-->

### Describe the problem

<!-- Provide a clear and concise description of the issue -->
When using the auth0-spa-js library, I set the cookieDomain option, which is propagated to the `CookieStorageWithLegacySameSite` class. When the library sets the `isAuthenticatedCookieName` during login, it sets the `cookieDomain` for the cookie for new browsers. But for legacy browsers it sets the cookie for the same domain where the login happened. There is no issue with this particularly.

The problem comes when I issue a logout through the library. Then the new cookie is cleared properly, but the legacy cookie is not cleared.

Then, during the next login, when the library calls `checkSession` it finds the legacy cookie and sees that the customer is authenticated for tha Auth0 application.

### What was the expected behavior?

The correct behavior is to clear both the new and the legacy cookie.

### Reproduction

<!--
> Detail the steps taken to reproduce this error, and whether this issue can be reproduced consistently or if it is intermittent.
> **Note**: If clear, reproducable steps or the smallest sample app demonstrating misbehavior cannot be provided, we may not be able to follow up on this bug report.
-->

To consistently reproduce the issue:

- Create the Auth0Client client with `cookieDomain: "mycompany.com"`
- Login at customerdomain.mycompany.com
- Check in the cookies that the new cookie is set with domain `mycompany.com` and the legacy cookie is set with domain `customerdomain.mycompany.com`
- Logout
- Check in the cookies that the new cookie is removed, but the legacy cookie is not.


**Can the behavior be reproduced using the [SPA SDK Playground](https://github.com/auth0/auth0-spa-js/blob/master/DEVELOPMENT.md#the-sdk-playground)?**

<!--
If so, provide steps:

> Where applicable, please include:
>
> - The smallest possible sample app that reproduces the undesirable behavior
> - Log files (redact/remove sensitive information)
> - Application settings (redact/remove sensitive information)
> - Screenshots
-->

When logged in:
![image](https://user-images.githubusercontent.com/81867642/216617653-533ba887-d964-4dfd-9053-c8c46f6d8a82.png)

When logged out:
![image](https://user-images.githubusercontent.com/81867642/216617751-15d44e88-f51d-4dff-bb6b-8b7e8d65d926.png)


### Environment

<!--
> Please provide the following:
-->

- **Version of `auth0-spa-js` used:** 1.22.4
- **Which browsers have you tested in?** Google Chrome Version 109.0.5414.119 (Official Build) (x86_64)
- **Which framework are you using, if applicable (Angular, React, etc):** AngularJS
- **Other modules/plugins/libraries that might be involved:** No.


Pull request:
Ensure cookieDomain is used when using legacy Cookiestorage
### Changes

The cookieDomain was not taken into consideration when saving the legacy cookie, but only when trying to remove it. This resulted in the fact that the legacy cookie is never removed when a cookieDomain was used.

### References

Closes #1070 

### Testing

- [x] This change adds unit test coverage
- [x] This change adds integration test coverage
- [x] This change has been tested on the latest version of the platform/language

### Checklist

- [x] I have read the [Auth0 general contribution guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md)
- [x] I have read the [Auth0 Code of Conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md)
- [x] All code quality tools/guidelines have been run/followed


Patch:
diff --git a/src/storage.ts b/src/storage.ts
index 132f01e..1b4bb6f 100644
--- a/src/storage.ts
+++ b/src/storage.ts
@@ -91,6 +91,10 @@ export const CookieStorageWithLegacySameSite = {
       cookieAttributes.expires = options.daysUntilExpire;
     }
 
+    if (options?.cookieDomain) {
+      cookieAttributes.domain = options.cookieDomain;
+    }
+
     Cookies.set(
       `${LEGACY_PREFIX}${key}`,
       JSON.stringify(value),


Test patch:
diff --git a/__tests__/Auth0Client/loginWithPopup.test.ts b/__tests__/Auth0Client/loginWithPopup.test.ts
index 0dcef3e..f883ebb 100644
--- a/__tests__/Auth0Client/loginWithPopup.test.ts
+++ b/__tests__/Auth0Client/loginWithPopup.test.ts
@@ -682,7 +682,8 @@ describe('Auth0Client', () => {
         `_legacy_auth0.${TEST_CLIENT_ID}.organization_hint`,
         JSON.stringify(TEST_ORG_ID),
         {
-          expires: 1
+          expires: 1,
+          domain: TEST_DOMAIN
         }
       );
 
@@ -702,11 +703,13 @@ describe('Auth0Client', () => {
       await loginWithPopup(auth0);
 
       expect(<jest.Mock>esCookie.remove).toHaveBeenCalledWith(
-        `_legacy_auth0.${TEST_CLIENT_ID}.organization_hint`, {}
+        `_legacy_auth0.${TEST_CLIENT_ID}.organization_hint`,
+        {}
       );
 
       expect(<jest.Mock>esCookie.remove).toHaveBeenCalledWith(
-        `auth0.${TEST_CLIENT_ID}.organization_hint`, {}
+        `auth0.${TEST_CLIENT_ID}.organization_hint`,
+        {}
       );
     });
 
diff --git a/__tests__/storage.test.ts b/__tests__/storage.test.ts
index 0925154..1d92ddb 100644
--- a/__tests__/storage.test.ts
+++ b/__tests__/storage.test.ts
@@ -132,7 +132,8 @@ describe('CookieStorageWithLegacySameSite', () => {
       `_legacy_${key}`,
       JSON.stringify(value),
       {
-        expires: options.daysUntilExpire
+        expires: options.daysUntilExpire,
+        domain: options.cookieDomain
       }
     );
   });