title: Cannot remove a cookie - Firefox rejecting cookies from the past
body: <p>I'm losing my mind here - I'm looking into an issue where some signout functionality in an application I have isn't working because the authentication cookie is not being cleared. The thing is that our &quot;signout&quot; endpoint does include the appropriate <code>set-cookie</code> header in the response - here's what I get looking at the raw response in Firefox:</p>
  <pre><code>set-cookie: Auth.myapp=; domain=app.mydomain.com; expires=Thu, 26-Nov-2020 13:19:20 GMT; path=/; secure; HttpOnly
  </code></pre>
  <p>Firefox is reporting this error in the console:</p>
  <blockquote>
  <p>Cookie “Auth.myapp” has been rejected because it is already expired</p>
  </blockquote>
  <p>This is kind of confusing, not only have I successfully used <code>set-cookie</code> with a past-date in <code>expires</code> before, it's even codified in <a href="https://www.rfc-editor.org/rfc/rfc6265" rel="nofollow noreferrer">RFC6265</a> as the accepted way to request a client remove a cookie:</p>
  <blockquote>
  <p>Finally, to remove a cookie, the server returns a Set-Cookie header
  with an expiration date in the past.  The server will be successful
  in removing the cookie only if the Path and the Domain attribute in
  the Set-Cookie header match the values used when the cookie was
  created.</p>
  </blockquote>
  <p>So I need to set an <code>expires</code> date in the past to clear the cookie ... but doing so causes the browser to reject it? Does anyone know what's going on here?</p>
  <p>To be clear I have checked that the cookie name, path, <code>secure</code> and <code>SameSite</code> match (update: I suspected that because I hadn't explicitly specified a SameSite this might be the cause, but after making sure the cookie is both set and cleared with <code>SameSite=None</code> it is still not working).</p>