Hey folks we are getting this on login:

{
  "errorCode": "E064001",
  "errorDescription": "JWT Expired due to logout",
  "errorMessage": "JWT token expired by logout",
  "message": "JWT token expired by logout"
}

we found the issue - we changed on descope the refresh token cookie domain. I now have 2 DSR cookies - one with api.islo.dev and one with auth.api.islo.dev. when i delete the old one (auth.api.islo.dev) it works. the DSR that is problematic is auth.api.islo.dev with SameSite None. How can we fix that?

@Bhagwanta Yeole Can you please look into this ?

Hello @Adam Gold , I'm looking into this, will get back to you.

Hi @Adam Gold Thanks for sharing the details this helps a lot. The error you’re seeing (

JWT Expired due to logout

) together with the two DSR cookies is happening because the browser is still sending the old refresh token cookie from the previous domain (

<http://auth.api.islo.dev|auth.api.islo.dev>

), and that token family has already been invalidated. So when Descope sees that cookie, it rejects it and you get the logout/expired JWT error. You just need to make sure there is only one refresh token cookie domain in use moving forward.

Thanks @Akash Jivane - I understand that. The question is how to fix this for my users now, that I can't ask them to delete cookies

@Adam Gold Are you looking to use both the domains together ?

no

@Adam Gold Has your issue been resolved?

unfortuantely not @Bhagwanta Yeole

Hi @Adam Gold Thanks for holding for long. Since you’re not planning to use both domains, the fix is to fully migrate to the new one and explicitly clean up the old refresh cookie once. Because Descope stores the refresh token in the

DSR

cookie (which is domain-scoped), the old cookie on

<http://auth.api.islo.dev|auth.api.islo.dev>

must be expired from that same domain — it can’t be deleted from the new one. 1. First thing that you can do is - Make sure the refresh token cookie domain is set only to:

<http://api.islo.dev|api.islo.dev>

don’t use

<http://auth.api.islo.dev|auth.api.islo.dev>

going forward. 2. Create a temporary cleanup endpoint on the old domain

<https://auth.api.islo.dev/cleanup>

That endpoint should return a response that sets the

DSR

cookie with: Domain:

<http://auth.api.islo.dev|auth.api.islo.dev>

• Path:

/

• Expiry: you can put any past date (e.g., Jan 1, 1970) • SameSite + Secure same as before This forces the browser to delete the stale cookie. 3. Redirect users once through this endpoint temporarily redirect users to:

<http://auth.api.islo.dev/cleanup|auth.api.islo.dev/cleanup>

the ideally it will redirect them back to:

<http://api.islo.dev|api.islo.dev>

That will silently remove the old cookie for everyone and no manual cookie clearing will be needed. After that, as long as only

<http://api.islo.dev|api.islo.dev>

is used for auth and cookie setting. Just please let me know if this solve your issue.

Thanks @Akash Jivane!