fix: Destroy authjs session using payload logout hook instead of overriding logout endpoints

CrawlerCode · CrawlerCode · commit 912da9ab9f89 · 2025-08-31T21:25:19.000+02:00
Until now, I have overwritten the logout endpoint to delete the authjs session cookies. However, this could also be achieved by adding an afterLogout hook and setting the cookies with Next.js. This simplifies the process and is likely to be the correct approach. This also corrects the logout server action that was introduced with payloadcms/payload#11900.
diff --git a/packages/payload-authjs/src/payload/collection/endpoints/logout.ts b/packages/payload-authjs/src/payload/collection/endpoints/logout.ts
diff --git a/packages/payload-authjs/src/payload/collection/hooks/logout.ts b/packages/payload-authjs/src/payload/collection/hooks/logout.ts
@@ -0,0 +1,51 @@
+import NextAuth from "next-auth";
+import { revalidateTag } from "next/cache";
+import { cookies } from "next/headers";
+import type { CollectionAfterLogoutHook } from "payload";
+import { withPayload } from "../../../authjs/withPayload";
+import { AUTHJS_STRATEGY_NAME } from "../../AuthjsAuthStrategy";
+import type { AuthjsPluginConfig } from "../../plugin";
+
+/**
+ * Add logout hook to destroy the authjs session
+ *
+ * @see https://payloadcms.com/docs/hooks/collections#afterlogout
+ * @see https://github.com/payloadcms/payload/blob/main/packages/payload/src/auth/operations/logout.ts
+ */
+export const logoutHook: (
+  pluginOptions: AuthjsPluginConfig,
+) => CollectionAfterLogoutHook = pluginOptions => {
+  // Return the logout hook
+  return async ({ req }) => {
+    // Check if user is authenticated using the authjs strategy
+    if (req.user?._strategy !== AUTHJS_STRATEGY_NAME) {
+      return;
+    }
+
+    // Create authjs instance
+    const { signOut } = NextAuth(
+      withPayload(pluginOptions.authjsConfig, {
+        payload: req.payload,
+        userCollectionSlug: pluginOptions.userCollectionSlug,
+      }),
+    );
+
+    // Sign out and generate expired cookies using authjs
+    const { cookies: authJsCookies } = (await signOut({ redirect: false })) as {
+      cookies: {
+        name: string;
+        value: string;
+        options: object;
+      }[];
+    };
+
+    // Destroy the authjs session cookies
+    const requestCookies = await cookies();
+    for (const cookie of authJsCookies) {
+      requestCookies.set(cookie.name, cookie.value, cookie.options);
+    }
+
+    // Revalidate the cache for the payload session
+    revalidateTag("payload-session");
+  };
+};
diff --git a/packages/payload-authjs/src/payload/collection/index.ts b/packages/payload-authjs/src/payload/collection/index.ts
@@ -4,12 +4,12 @@ import { AuthjsAuthStrategy } from "../AuthjsAuthStrategy";
 import type { AuthjsPluginConfig } from "../plugin";
 import { mergeFields } from "../utils/mergeFields";
 import { defaultAccess } from "./access";
-import { logoutEndpoint } from "./endpoints/logout";
 import { refreshEndpoint } from "./endpoints/refresh";
 import { accountsField } from "./fields/accounts";
 import { generalFields } from "./fields/general";
 import { sessionsField } from "./fields/session";
 import { verificationTokensField } from "./fields/verificationTokens";
+import { logoutHook } from "./hooks/logout";
 import { meHook } from "./hooks/me";
 import { refreshHook } from "./hooks/refresh";
 
@@ -103,13 +103,12 @@ export const generateUsersCollection = (
     ...collection.hooks,
     me: [...(collection.hooks?.me || []), meHook(collection, pluginOptions)],
     refresh: [...(collection.hooks?.refresh || []), refreshHook(collection, pluginOptions)],
+    afterLogout: [...(collection.hooks?.afterLogout || []), logoutHook(pluginOptions)],
   };
 
   // Add custom endpoints to users collection
   collection.endpoints = [
     ...(collection.endpoints || []),
-    // Add the logout endpoint
-    logoutEndpoint(pluginOptions),
     // Add the refresh endpoint
     refreshEndpoint(pluginOptions),
   ];
