From 503ff732fc361df3209a12673401b78d8ac414ac Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Wed, 8 Oct 2025 22:39:43 +0200 Subject: [PATCH] Fix cookie not set on custom domain Signed-off-by: Bryan Frimin --- .../trust/v1/trust_center_access_handler.go | 22 +++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/pkg/server/api/trust/v1/trust_center_access_handler.go b/pkg/server/api/trust/v1/trust_center_access_handler.go index 813815307..39b8460ab 100644 --- a/pkg/server/api/trust/v1/trust_center_access_handler.go +++ b/pkg/server/api/trust/v1/trust_center_access_handler.go @@ -95,10 +95,19 @@ func authTokenHandler(trustSvc *trust.Service, trustAuthCfg TrustAuthConfig) htt return } + // Determine cookie domain: use custom domain if present, otherwise use configured domain + cookieDomain := trustAuthCfg.CookieDomain + if _, ok := GetCustomDomainOrganizationID(r.Context()); ok { + // On custom domain, use the request host + if r.TLS != nil && r.TLS.ServerName != "" { + cookieDomain = r.TLS.ServerName + } + } + cookie := &http.Cookie{ Name: trustAuthCfg.CookieName, Value: tokenString, - Domain: trustAuthCfg.CookieDomain, + Domain: cookieDomain, Path: "/", MaxAge: int(trustAuthCfg.CookieDuration / time.Second), Secure: true, @@ -135,10 +144,19 @@ func validateTrustCenterAccessToken(ctx context.Context, trustSvc *trust.Service func trustCenterLogoutHandler(authCfg console_v1.AuthConfig, trustAuthCfg TrustAuthConfig) http.HandlerFunc { return func(w http.ResponseWriter, r *http.Request) { + // Determine cookie domain: use custom domain if present, otherwise use configured domain + cookieDomain := trustAuthCfg.CookieDomain + if _, ok := GetCustomDomainOrganizationID(r.Context()); ok { + // On custom domain, use the request host + if r.TLS != nil && r.TLS.ServerName != "" { + cookieDomain = r.TLS.ServerName + } + } + http.SetCookie(w, &http.Cookie{ Name: trustAuthCfg.CookieName, Value: "", - Domain: trustAuthCfg.CookieDomain, + Domain: cookieDomain, Path: "/", MaxAge: -1, Secure: true,