When Discourse is hosted from a subfolder (e.g. /forum) it seems that the cookie is still set to the root folder /. To me this sounds like a potential security issue. For example, if a forum is hosted in /forum and a WordPress blog is hosted in /blog, the cookie with Discourse session is sent also …

I reverted the other fix, so you should undo that change since it’s worse behaviour than before. I don’t understand what you’re seeing, or how to fix what I’m seeing.

[Bild] neil: I don’t understand what you’re seeing, or how to fix what I’m seeing. maybe its time for big boss @sam to step in !!

We are deferring on this for now. Running two instances of Discourse on the same domain in different subfolders is not a supported config at the moment. We may circle back to this in a few months, though.

[Bild] codinghorror: We are deferring on this for now. Running two instances of Discourse on the same domain in different subfolders is not a supported config at the moment. We may circle back to this in a few months, though. makes sense … being able to say 'No" creates a great product.

We will give another go at this soon.

As @vikaskedia mentioned earlier, there is a workaround. You can use a different cookie name for each subfolder by using DISCOURSE_TOKEN_COOKIE in your configuration. However, there is still a bug here where cookies are not properly restricted to paths on subfolder installs, causing conflicts with …

Can you scope how much work this would be, in terms of “T-shirt sizing”? Small, Medium, Large, XL, XXL?

Somewhere between small and medium. It would log everyone off though when “fixed / changed”

Hmm that is fairly traumatic. Is there any way to fix it so it only logs people out on subfolder setups at least?

Pfad zu Cookie hinzufügen

Entwickler

vikaskedia (Vikas Kedia) 29. März 2018 um 22:44 35

Please close this issue. It works now. By setting the DISCOURSE_TOKEN_COOKIE env var.

Thanks @Falco @neil

Well done !!

5 „Gefällt mir“

Thema		Antworten	Aufrufe
Serve Discourse from a subfolder (path prefix) instead of a subdomain Self-Hosting docker , subfolder , how-to , advanced-setup	29	43077	8. Januar 2025
Setting the session token '_t' on the entire domain, not just my subdomain Dev	6	5424	1. Mai 2016
Address Bar changes under subfolder Support	1	457	28. Juni 2020
Put discourse on a sub url Support	6	1401	7. August 2020
Generals Subfolder recommendations and tips Self-hosting	9	2048	12. Januar 2020

Pfad zu Cookie hinzufügen

Verwandte Themen