> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

# Catalyst version 1.12.1 release notes

> Catalyst 1.12.1 preserves the configured Auth.js session-token cookie attributes when the token is rewritten as a browser-session cookie, so storefronts using partitioned cookies no longer strand a duplicate session token that survives logout.

Catalyst 1.12.1 is a patch release. It fixes a logout redirect loop on storefronts that customize their Auth.js session-token cookie: rewriting the token as a browser-session cookie discarded the configured attributes, and on partitioned cookies that wrote a second token the logout could not clear. For a full list of Catalyst changes, see the [changeset on GitHub](https://github.com/bigcommerce/catalyst/blob/canary/core/CHANGELOG.md#1121).

## Session token cookie attributes

After sign-in, Catalyst rewrites the Auth.js session-token cookies so the session ends when the browser closes. The rewrite has to drop the cookie's `expires` and `maxAge`, since those are what make it persistent.

It also dropped everything else. The rewrite wrote a fixed attribute set — `httpOnly`, `sameSite: 'lax'`, `path: '/'`, and `secure` inferred from the `__Secure-` name prefix — and ignored whatever `cookies.sessionToken.options` supplied in your Auth.js config.

For most storefronts the fixed set matched the configured one and nothing changed. For storefronts that set additional attributes, the rewrite silently reverted them.

## Duplicate tokens on partitioned cookies

`partitioned` is the attribute where this became visible. Browsers key a cookie by its partition alongside its name, domain, and path, so a partitioned cookie and an unpartitioned cookie of the same name are two distinct cookies. Rewriting a partitioned session token without the `partitioned` attribute therefore did not replace the original. It added a second one.

Both were then sent on subsequent requests. Signing out cleared the partitioned cookie, because that is what the Auth.js config describes, and left the unpartitioned duplicate in place. The stale token kept the shopper authenticated, so the app bounced them back out of the login flow in a redirect loop.

## The fix

A new `getSessionTokenCookieOptions` helper in `core/lib/auth/session-token-cookie-options.ts` builds the rewrite's attributes from your configured `cookies.sessionToken.options`, removing only `expires` and `maxAge`. Anything else you configure, including `partitioned` and a non-default `sameSite`, carries through to the browser-session cookie, so the rewrite updates the original cookie instead of creating a sibling.

The same defaults apply when nothing is configured, so storefronts that have not customized their session cookie see no change in behavior.

## Migration

None. This release contains no breaking changes and requires no configuration updates.

## Release tags

* [**@bigcommerce/catalyst-core@1.12.1**](https://github.com/bigcommerce/catalyst/releases/tag/%40bigcommerce%2Fcatalyst-core%401.12.1)

Latest stable:

* [**@bigcommerce/catalyst-core@latest**](https://github.com/bigcommerce/catalyst/releases/tag/%40bigcommerce%2Fcatalyst-core%40latest)
* [**@bigcommerce/catalyst-makeswift@latest**](https://github.com/bigcommerce/catalyst/releases/tag/%40bigcommerce%2Fcatalyst-makeswift%40latest)