From 6ddb36ae75490d5946e4f51614e60bb466fe76e5 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Sat, 31 Oct 2026 09:08:07 +0100
Subject: [PATCH] Bugfix/limit cookie clearance in sign-out logic (#8350)

* Delete Bull Board cookie

* Update changelog
---
 CHANGELOG.md                                  |  4 +++
 .../src/app/services/user/user.service.ts     | 26 +++----------------
 2 files changed, 8 insertions(+), 22 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 61c96bb299..e717975ff7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Upgraded `uuid` from version `14.0.2` to `14.0.3`
 - Upgraded `yahoo-finance2` from version `4.0.2` to `4.0.5`
 
+### Fixed
+
+- Fixed the sign-out logic which deleted all cookies of the origin and did not delete the _Bull Board_ cookie on plain HTTP
+
 ## 3.94.0 - 2026-10-28
 
 ### Changed
diff --git a/apps/client/src/app/services/user/user.service.ts b/apps/client/src/app/services/user/user.service.ts
index 12e34c330b..ebc3a5fb96 100644
--- a/apps/client/src/app/services/user/user.service.ts
+++ b/apps/client/src/app/services/user/user.service.ts
@@ -1,5 +1,6 @@
 import { KEY_SUBSCRIPTION_INTERSTITIAL_SHOWN } from '@ghostfolio/client/services/settings-storage.service';
 import { WebAuthnService } from '@ghostfolio/client/services/web-authn.service';
+import { BULL_BOARD_COOKIE_NAME } from '@ghostfolio/common/config';
 import { Filter, User } from '@ghostfolio/common/interfaces';
 import { hasPermission, permissions } from '@ghostfolio/common/permissions';
 
@@ -109,7 +110,7 @@ export class UserService extends ObservableStore<UserStoreState> {
     window.localStorage.clear();
     window.sessionStorage.clear();
 
-    void this.clearAllCookies();
+    this.clearBullBoardCookie();
 
     this.reset();
 
@@ -118,27 +119,8 @@ export class UserService extends ObservableStore<UserStoreState> {
     }
   }
 
-  private async clearAllCookies() {
-    if (!('cookieStore' in window)) {
-      console.warn('Cookie Store API not available in this browser');
-      return;
-    }
-
-    const cookies = await cookieStore.getAll();
-
-    const cookieNames = cookies
-      .map(({ name }) => {
-        return name;
-      })
-      .filter((name): name is string => {
-        return !!name;
-      });
-
-    await Promise.all(
-      cookieNames.map((name) => {
-        return cookieStore.delete(name);
-      })
-    );
+  private clearBullBoardCookie() {
+    document.cookie = `${BULL_BOARD_COOKIE_NAME}=; Max-Age=0; path=/`;
   }
 
   private fetchUser(): Observable<User> {