cookie_key is rewriten in ApiBasketMiddleWare.process_response()

[twil]

This line https://github.com/django-oscar/django-oscar-api/blob/master/oscarapi/middleware.py#L202

for cookie_key in cookies_to_delete:
    response.delete_cookie(cookie_key)

overwrites line 196 if cookies_to_delete is not empty

cookie_key = self.get_cookie_key(request)

[maerteijn]

You are right and this can be considered a bug, thanks for reporting.

Need to fix this and probably write a test for it.

[maerteijn]

@twil
I expected the following test to fail, see 658090e#diff-f35e3692dec538e7c17d3cb43da39e2eR141

But it isn't, probably due to https://github.com/django-oscar/django-oscar-api/blob/master/oscarapi/middleware.py#L163.

So yes, the code needs to be changed, and now I think it's even not needed. But I'm not sure so let's ask @specialunderwear

I'm not 100% confident here, as this middleware is a bit spooky 😄

[twil]

@maerteijn yep, spooky indeed:)

The test doesn't fail because cookies_to_delete is empty. I see how it can be used but can't find where it is used.

[maerteijn]

For future reference Related branch: https://github.com/django-oscar/django-oscar-api/tree/fix-cookie-key-bug-in-middleware