Catalyst version 1.12.1 release notes
Catalyst 1.12.1 is a patch release. It fixes a logout redirect loop on storefronts that customize their Auth.js session-token cookie: rewriting the token as a browser-session cookie discarded the configured attributes, and on partitioned cookies that wrote a second token the logout could not clear. For a full list of Catalyst changes, see the changeset on GitHub.
Session token cookie attributes
After sign-in, Catalyst rewrites the Auth.js session-token cookies so the session ends when the browser closes. The rewrite has to drop the cookie’s expires and maxAge, since those are what make it persistent.
It also dropped everything else. The rewrite wrote a fixed attribute set — httpOnly, sameSite: 'lax', path: '/', and secure inferred from the __Secure- name prefix — and ignored whatever cookies.sessionToken.options supplied in your Auth.js config.
For most storefronts the fixed set matched the configured one and nothing changed. For storefronts that set additional attributes, the rewrite silently reverted them.
Duplicate tokens on partitioned cookies
partitioned is the attribute where this became visible. Browsers key a cookie by its partition alongside its name, domain, and path, so a partitioned cookie and an unpartitioned cookie of the same name are two distinct cookies. Rewriting a partitioned session token without the partitioned attribute therefore did not replace the original. It added a second one.
Both were then sent on subsequent requests. Signing out cleared the partitioned cookie, because that is what the Auth.js config describes, and left the unpartitioned duplicate in place. The stale token kept the shopper authenticated, so the app bounced them back out of the login flow in a redirect loop.
The fix
A new getSessionTokenCookieOptions helper in core/lib/auth/session-token-cookie-options.ts builds the rewrite’s attributes from your configured cookies.sessionToken.options, removing only expires and maxAge. Anything else you configure, including partitioned and a non-default sameSite, carries through to the browser-session cookie, so the rewrite updates the original cookie instead of creating a sibling.
The same defaults apply when nothing is configured, so storefronts that have not customized their session cookie see no change in behavior.
Migration
None. This release contains no breaking changes and requires no configuration updates.
Release tags
Latest stable: