From b05330c0c877292398d64b6f84f3006f52607e55 Mon Sep 17 00:00:00 2001
From: Karl Ludwig Weise <ludwig@ludwigweise.de>
Date: Mon, 26 Jan 2026 20:46:42 +0100
Subject: [PATCH] Fix failed login with access_token. Remove access_token when
 loading login route

---
 src/routes/(pages)/login/+page.server.ts | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/routes/(pages)/login/+page.server.ts b/src/routes/(pages)/login/+page.server.ts
index 93a5a45..72df540 100644
--- a/src/routes/(pages)/login/+page.server.ts
+++ b/src/routes/(pages)/login/+page.server.ts
@@ -1,7 +1,7 @@
 import { fail } from "@sveltejs/kit";
 import { superValidate } from "sveltekit-superforms";
 import { zod4 as zod } from "sveltekit-superforms/adapters";
-import type { Actions } from "./$types";
+import type { Actions, PageServerLoad } from "./$types";
 import { formSchema } from "./schema";
 import type { WebAuthnCredential } from "$lib/server/auth/webauthn-service";
 import type { TUser } from "$lib/types/user";
@@ -9,6 +9,16 @@ import logger from "$lib/logger";
 
 const log = logger.setContext(import.meta.filename);
 
+export const load: PageServerLoad = async (event) => {
+  // Remove any existing access token cookie
+  event.cookies.delete("access_token", {
+    path: "/",
+    httpOnly: true,
+    secure: true,
+    sameSite: "strict",
+  });
+};
+
 export const actions: Actions = {
   default: async (event) => {
     const form = await superValidate(event, zod(formSchema));