Merge pull request #6167 from kenjis/fix-session-cookie-twice-ajax

fix: Session cookies are sent twice with Ajax

Author: kenjis

system/Session/Session.php

@@ -411,6 +411,28 @@ public function regenerate(bool $destroy = false)
     {
         $_SESSION['__ci_last_regenerate'] = time();
         session_regenerate_id($destroy);
+
+        $this->removeOldSessionCookie();
+    }
+
+    private function removeOldSessionCookie(): void
+    {
+        $response              = Services::response();
+        $cookieStoreInResponse = $response->getCookieStore();
+
+        if (! $cookieStoreInResponse->has($this->sessionCookieName)) {
+            return;
+        }
+
+        // CookieStore is immutable.
+        $newCookieStore = $cookieStoreInResponse->remove($this->sessionCookieName);
+
+        // But clear() method clears cookies in the object (not immutable).
+        $cookieStoreInResponse->clear();
+
+        foreach ($newCookieStore as $cookie) {
+            $response->setCookie($cookie);
+        }
     }
 
     /**