When Discourse is hosted from a subfolder (e.g. /forum) it seems that the cookie is still set to the root folder /. To me this sounds like a potential security issue. For example, if a forum is hosted in /forum and a WordPress blog is hosted in /blog, the cookie with Discourse session is sent also to the WordPress site. This should be pretty easy to fix by changing config/initializer/100-session_store.rb from Discourse::Application.config.session_store :cookie_store, key: '_forum_session' to Discourse::Application.config.session_store( :cookie_store, key: '_forum_session', path: (Rails.application.config.relative_url_root.nil?) ? '/' : Rails.application.config.relative_url_root ) To my understanding this change shouldn’t invalidate existing sessions, because cookies for root folder / work also for subdirectory /forum. So the migration path should be ok. Does this make sense? I could make a PR if you think this makes sense.

I tested the change and it’s safe. Sessions aren’t invalidated. I committed the change today. [תמונה] rap1ds: There’s no need for different subdomain if the cookies are scoped by the path. Or are there any other reasons why one couldn’t host two Discourse instances from different folders? Serving multiple Discourse instances from different paths on the same domain will most likely work now, but note that the instances can’t be served from one multisite setup. Multisite is still keyed off of domain, not path.

@neil [תמונה] neil: Serving multiple Discourse instances from different paths on the same domain will most likely work now I have 2 discourse setups. setup 1 running from www.site.com/d1/ setup 2 running from www.site.com/d2/ Problems noticed I cannot remain logged into both the discourse setups at the same time If I am logged into d1 and I refresh d2 I am logged out of d1. More information about the setup: Both are running in their own docker containers using their own DB installed using discourse_docker version is 1.9 beta2

Yeah we have a bug here: lib/auth/default_current_user_provider.rb main # possible we have an api call, impersonate if api_key current_user = lookup_api_user(api_key, request) if !current_user raise Discourse::InvalidAccess.new( I18n.t("invalid_api_credentials"), nil, custom_message: "invalid_api_credentials", ) end raise Discourse::InvalidAccess if current_user.suspended? || !current_user.active if !Rails.env.profile? We need to explicitly add the path there, just like session has the path. Unfortunately fixing this will log everyone off on all subfolder installs, but still, it is probably worth fixing. @neil maybe look at adding path there?

@neil let me know once you commit the fix .. I can check it out if it works ..

@vikaskedia I pushed a fix so please try it out.

Ok I am following the steps here to upgrade: [תמונה] Manually update Discourse and Docker image to latest Self-Hosting bookmark This guide provides step-by-step instructions for manually updating Discourse, the Docker container, and the Ubuntu operating system on a self-hosted setup. person_raising_hand Required user level: System Administrator warning SSH access to the server. If you self-host Discourse, you occasionally need to run a manual update via the command line to get the latest security releases and newest libraries. These updates are not picked up in admin/upgrade, which is why you’ll occa… and will let you know soon

@neil damm man .. it works !! I am successfully logged into www.site.com/d1/ and www.site.com/d2/ Very good .. :penguin:

@neil I just started getting “internal server error 500” can this be related to the above fix … [תמונה] The error auto corrects itself in a couple of minutes. So it seems to indicate it is the “rate limiting” issue. But this is just me using the site and its a beefy server … and i am seeing it for the first time after i upgraded. :grimacing:

Looks like your subfolder is missing? “/subfolder/faq”

[תמונה] neil: Looks like your subfolder is missing? “/subfolder/faq” If the subfolder was missing the error will come all the time. This error is a transient error ..

הוסף נתיב לעוגיה

מפתח

vikaskedia (Vikas Kedia) 20 ביוני,‏ 2017,‏ 5:49pm 11

Ok I am following the steps here to upgrade:

and will let you know soon

נושא		תגובות	צפיות
Serve Discourse from a subfolder (path prefix) instead of a subdomain Self-Hosting docker , subfolder , how-to , advanced-setup	30	45025	14 באפריל,‏ 2026
Setting the session token '_t' on the entire domain, not just my subdomain Development	6	5624	1 במאי,‏ 2016
Address Bar changes under subfolder Product Support	1	526	28 ביוני,‏ 2020
Put discourse on a sub url Product Support	5	1556	8 ביולי,‏ 2020
Generals Subfolder recommendations and tips Self-hosting	8	2273	1 בנובמבר,‏ 2016

הוסף נתיב לעוגיה

נושאים קשורים