# Add path to cookie **URL:** https://meta.discourse.org/t/add-path-to-cookie/40218 **Category:** Development **Created:** [February 26, 2016, 9:42am UTC](https://meta.discourse.org/t/add-path-to-cookie/40218 "2016-02-26T09:42:05Z") **Posts on this page:** 20 **Page:** 1
### Author: ![rap1ds](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rap1ds/32/121941_2.png) [@rap1ds](https://meta.discourse.org/u/rap1ds) #### Post date: [February 26, 2016, 9:42am UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/1 "2016-02-26T09:42:05Z")
When Discourse is hosted from a subfolder (e.g. `/forum`) it seems that the cookie is still set to the root folder `/`. To me this sounds like a potential security issue. For example, if a forum is hosted in `/forum` and a WordPress blog is hosted in `/blog`, the cookie with Discourse session is sent also to the WordPress site. This should be pretty easy to fix by changing `config/initializer/100-session_store.rb` from ```plaintext Discourse::Application.config.session_store :cookie_store, key: '_forum_session' ``` to ```plaintext Discourse::Application.config.session_store( :cookie_store, key: '_forum_session', path: (Rails.application.config.relative_url_root.nil?) ? '/' : Rails.application.config.relative_url_root ) ``` To my understanding this change shouldn’t invalidate existing sessions, because cookies for root folder `/` work also for subdirectory `/forum`. So the migration path should be ok. Does this make sense? I could make a PR if you think this makes sense. ---
### Author: ![rap1ds](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rap1ds/32/121941_2.png) [@rap1ds](https://meta.discourse.org/u/rap1ds) #### Post date: [February 26, 2016, 10:01am UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/2 "2016-02-26T10:01:15Z")
One addition. In this guide [Use a subfolder (path prefix) to serve Discourse with multiple servers sharing a domain](https://meta.discourse.org/t/discourse-in-a-subfolder-multiple-servers-sharing-a-domain/30514) it says that > Note: This won’t work for serving multiple Discourse instances from different folders on the same domain. You need to use different subdomains so that each site can have different cookies. So with this change you could remove that note. There’s no need for different subdomain if the cookies are scoped by the path. Or are there any other reasons why one couldn’t host two Discourse instances from different folders? ---
### Author: ![gerhard](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gerhard/32/119479_2.png) [@gerhard](https://meta.discourse.org/u/gerhard) #### Post date: [February 26, 2016, 12:19pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/3 "2016-02-26T12:19:36Z")
It would be nice if Discourse set the correct cookie path, but it’s definitely not a security issue. > ---
### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror) #### Post date: [February 26, 2016, 8:54pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/4 "2016-02-26T20:54:52Z")
@neil we should look at doing this if it is not too risky. Feels risky to me for live sites though.. ---
### Author: ![neil](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/neil/32/102150_2.png) [@neil](https://meta.discourse.org/u/neil) #### Post date: [March 1, 2016, 10:05pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/5 "2016-03-01T22:05:24Z")
> [@rap1ds](#): > > I could make a PR if you think this makes sense. Yes please submit a PR. 😄 I’ll test it out myself to see how it impacts live sites after a deploy. ---
### Author: ![neil](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/neil/32/102150_2.png) [@neil](https://meta.discourse.org/u/neil) #### Post date: [March 7, 2016, 6:43pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/6 "2016-03-07T18:43:58Z")
I tested the change and it’s safe. Sessions aren’t invalidated. I committed the change today. > [@rap1ds](#): > > There’s no need for different subdomain if the cookies are scoped by the path. Or are there any other reasons why one couldn’t host two Discourse instances from different folders? Serving multiple Discourse instances from different paths on the same domain will most likely work now, but note that the instances can’t be served from one [multisite setup](https://meta.discourse.org/t/multisite-configuration-with-docker/14084). Multisite is still keyed off of domain, not path. ---
### Author: ![vikaskedia](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vikaskedia/32/73333_2.png) [@vikaskedia](https://meta.discourse.org/u/vikaskedia) #### Post date: [June 20, 2017, 12:46pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/7 "2017-06-20T12:46:06Z")
@neil > [@neil](#): > > Serving multiple Discourse instances from different paths on the same domain will most likely work now I have 2 discourse setups. setup 1 running from [www.site.com/d1/](http://www.site.com/d1/) setup 2 running from [www.site.com/d2/](http://www.site.com/d2/) # Problems noticed 1. I cannot remain logged into both the discourse setups at the same time 2. If I am logged into d1 and I refresh d2 I am logged out of d1. # More information about the setup: 1. Both are running in their own docker containers using their own DB 2. installed using discourse\_docker 3. version is 1.9 beta2 ---
### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam) #### Post date: [June 20, 2017, 1:13pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/8 "2017-06-20T13:13:06Z")
Yeah we have a bug here: > We need to explicitly add the path there, just like session has the path. Unfortunately fixing this will log everyone off on all subfolder installs, but still, it is probably worth fixing. @neil maybe look at adding path there? ---
### Author: ![vikaskedia](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vikaskedia/32/73333_2.png) [@vikaskedia](https://meta.discourse.org/u/vikaskedia) #### Post date: [June 20, 2017, 2:49pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/9 "2017-06-20T14:49:45Z")
@neil let me know once you commit the fix .. I can check it out if it works .. ---
### Author: ![neil](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/neil/32/102150_2.png) [@neil](https://meta.discourse.org/u/neil) #### Post date: [June 20, 2017, 5:31pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/10 "2017-06-20T17:31:10Z")
@vikaskedia I pushed a fix so please try it out. ---
### Author: ![vikaskedia](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vikaskedia/32/73333_2.png) [@vikaskedia](https://meta.discourse.org/u/vikaskedia) #### Post date: [June 20, 2017, 5:49pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/11 "2017-06-20T17:49:04Z")
Ok I am following the steps here to upgrade: > [@Manually update Discourse and Docker image to latest](https://meta.discourse.org/t/how-do-i-manually-update-discourse-and-docker-image-to-latest/23325): > > bookmark This guide provides step-by-step instructions for manually updating Discourse, the Docker container, and the Ubuntu operating system on a self-hosted setup. person_raising_hand Required user level: System Administrator warning SSH access to the server. If you self-host Discourse, you occasionally need to run a manual update via the command line to get the latest security releases and newest libraries. These updates are not picked up in admin/upgrade, which is why you’ll occa… and will let you know soon ---
### Author: ![vikaskedia](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vikaskedia/32/73333_2.png) [@vikaskedia](https://meta.discourse.org/u/vikaskedia) #### Post date: [June 20, 2017, 6:59pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/12 "2017-06-20T18:59:10Z")
@neil damm man .. it works !! I am successfully logged into [www.site.com/d1/](http://www.site.com/d1/) and [www.site.com/d2/](http://www.site.com/d2/) Very good .. 🐧 ---
### Author: ![vikaskedia](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vikaskedia/32/73333_2.png) [@vikaskedia](https://meta.discourse.org/u/vikaskedia) #### Post date: [June 20, 2017, 8:23pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/13 "2017-06-20T20:23:34Z")
@neil I just started getting “internal server error 500” can this be related to the above fix … ![](https://global.discourse-cdn.com/meta/original/3X/f/f/ff9183bb89c465f868dcc41bf20bbfe85d2ba59b.png) The error auto corrects itself in a couple of minutes. So it seems to indicate it is the “rate limiting” issue. But this is just me using the site and its a beefy server … and i am seeing it for the first time after i upgraded. 😬 ---
### Author: ![neil](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/neil/32/102150_2.png) [@neil](https://meta.discourse.org/u/neil) #### Post date: [June 20, 2017, 8:27pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/14 "2017-06-20T20:27:04Z")
Looks like your subfolder is missing? “/subfolder/faq” ---
### Author: ![vikaskedia](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vikaskedia/32/73333_2.png) [@vikaskedia](https://meta.discourse.org/u/vikaskedia) #### Post date: [June 20, 2017, 8:28pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/15 "2017-06-20T20:28:48Z")
> [@neil](#): > > Looks like your subfolder is missing? “/subfolder/faq” If the subfolder was missing the error will come all the time. This error is a transient error .. ---
### Author: ![neil](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/neil/32/102150_2.png) [@neil](https://meta.discourse.org/u/neil) #### Post date: [June 20, 2017, 9:53pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/16 "2017-06-20T21:53:27Z")
It sounds like another problem we saw today. @sam seems like [this code](https://github.com/discourse/discourse/blob/master/lib/auth/default_current_user_provider.rb#L46-L66) is being hit in this case too? The cookie is invalid now? ---
### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam) #### Post date: [June 20, 2017, 9:58pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/17 "2017-06-20T21:58:11Z")
I tested on local and it tries to reset the cookie, I guess it is failing cause it can no longer reset the cookie from the top level path ---
### Author: ![vikaskedia](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vikaskedia/32/73333_2.png) [@vikaskedia](https://meta.discourse.org/u/vikaskedia) #### Post date: [June 21, 2017, 4:53am UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/18 "2017-06-21T04:53:14Z")
> [@sam](#): > > I tested on local and it tries to reset the cookie, I guess it is failing cause it can no longer reset the cookie from the top level path Related ? [https://meta.discourse.org/t/video-demo-of-oauth2-failing-intermitently/64835](https://meta.discourse.org/t/video-demo-of-oauth2-failing-intermitently/64835) ---
### Author: ![vikaskedia](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vikaskedia/32/73333_2.png) [@vikaskedia](https://meta.discourse.org/u/vikaskedia) #### Post date: [June 21, 2017, 2:46pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/19 "2017-06-21T14:46:37Z")
> [@neil](#): > > It sounds like another problem we saw today. @sam seems like this code is being hit in this case too? The cookie is invalid now? Let me know when you release a fix .. I will check it out .. ---
### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam) #### Post date: [June 21, 2017, 3:12pm UTC](https://meta.discourse.org/t/add-path-to-cookie/40218/20 "2017-06-21T15:12:36Z")
Try deleting cookies, does the problem go away? [Next page](https://meta.discourse.org/t/add-path-to-cookie/40218.md?page=2)