I’m trying to unset my cookie on an https site. The cookie was set by the server after successful login but chrome is not unsetting the cookie when logout is called even though the Set-Cookie header is present on the response headers with the correct directives.

@api_view(['POST'])
def login(request):
    data = request.data
    email = data.get('email')
    password = data.get('password')
    
    if not email or not password:
        return JsonResponse({'error': 'Email and password are required'}, status=400)
    
    user = authenticate_user(email, password)
    
    if user is not None:
        token = RefreshToken.for_user(user)
        # Create response object
        response = JsonResponse({'message': 'Login successful'})
        
        # Set the token in a secure, HTTP-only cookie
        response.set_cookie(
            key='access_token',
            value=str(token.access_token),
            httponly=True,
            secure=True,  # Ensure you use HTTPS
            samesite='Lax',
            path='/',
            domain='my-domain.com'
        )
        
        return response
    else:
        # Authentication failed
        return JsonResponse({'error': 'Invalid credentials'}, status=401)

This is my logout method:

@api_view(['POST'])
def logout(request):
    # Create response object
    response = JsonResponse({'message': 'Logout successful'})
    
    response.set_cookie(
        'access_token',
        value='',
        max_age=0,
        path='/',
        secure=True,
        httponly=True,
        samesite='Lax',
        domain='my-domain.com'
    )
    
    return response

Additionally I have the following in my settings.py file:

SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = 'Lax'
SESSION_COOKIE_PATH = '/'
CSRF_COOKIE_PATH = '/'
SESSION_COOKIE_DOMAIN = 'my-domain.com'
CSRF_COOKIE_DOMAIN = 'my-domain.com'

I’ve tested on Firefox and also in incognito mode. What could possibly be causing the cookies not to be unset by my logout method?