Skip to content

[ci-test] PR-F SESSION_COOKIE_DOMAIN — fork CI sandbox#3

Closed
MichaelUray wants to merge 2 commits into
developfrom
ci-test/pr-f-session-cookie-domain
Closed

[ci-test] PR-F SESSION_COOKIE_DOMAIN — fork CI sandbox#3
MichaelUray wants to merge 2 commits into
developfrom
ci-test/pr-f-session-cookie-domain

Conversation

@MichaelUray

Copy link
Copy Markdown
Owner

Fork-internal CI testing. Single-commit fix in pods/authProviders/src/index.ts.

BykhovDenis and others added 2 commits June 24, 2026 21:00
Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>
…n OIDC

koa-session defaults the cookie domain to the request host. OIDC flows
that start on one subdomain (dev.example.com) and get the callback
on another (app.example.com, the host registered with the IdP) lose
the Passport state — the cookie set on dev isn't sent to app, so the
callback handler errors with 'did not find expected authorization
request details in session'.

SESSION_COOKIE_DOMAIN=.example.com scopes the cookie to the parent
domain so both subdomains share it. Empty / unset preserves the prior
behaviour for setups that only use a single host.

Signed-off-by: Michael Uray <michaeluray@users.noreply.github.com>
@MichaelUray

Copy link
Copy Markdown
Owner Author

CI sandbox complete. Upstream PR opened: hcengineering#10929

MichaelUray pushed a commit that referenced this pull request Jul 9, 2026
@MichaelUray
MichaelUray deleted the ci-test/pr-f-session-cookie-domain branch July 9, 2026 11:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants