One does not simply delete cookies

The author explains why deleting authentication cookies with Astro's cookies API worked in development but failed in production. Cookies are not removed by server code: Astro.cookies.delete sends a Set-Cookie response header that sets the value to "deleted" with an expiry date in the past, and browsers then stop sending expired cookies. In production, the Auth.js cookies used the __Host- and __Secure- prefixes, and the browser blocked the Set-Cookie headers because their options did not match the existing cookies. Adding httpOnly, secure and path options to the delete calls fixed the logout, and the author then opened a pull request to the Astro docs to clarify this behavior.