When Discourse is hosted from a subfolder (e.g. /forum) it seems that the cookie is still set to the root folder /. To me this sounds like a potential security issue. For example, if a forum is hosted in /forum and a WordPress blog is hosted in /blog, the cookie with Discourse session is sent also …

I reverted the other fix, so you should undo that change since it’s worse behaviour than before. I don’t understand what you’re seeing, or how to fix what I’m seeing.

[imagem] neil: I don’t understand what you’re seeing, or how to fix what I’m seeing. maybe its time for big boss @sam to step in !!

We are deferring on this for now. Running two instances of Discourse on the same domain in different subfolders is not a supported config at the moment. We may circle back to this in a few months, though.

[imagem] codinghorror: We are deferring on this for now. Running two instances of Discourse on the same domain in different subfolders is not a supported config at the moment. We may circle back to this in a few months, though. makes sense … being able to say 'No" creates a great product.

We will give another go at this soon.

As @vikaskedia mentioned earlier, there is a workaround. You can use a different cookie name for each subfolder by using DISCOURSE_TOKEN_COOKIE in your configuration. However, there is still a bug here where cookies are not properly restricted to paths on subfolder installs, causing conflicts with …

Can you scope how much work this would be, in terms of “T-shirt sizing”? Small, Medium, Large, XL, XXL?

Somewhere between small and medium. It would log everyone off though when “fixed / changed”

Hmm that is fairly traumatic. Is there any way to fix it so it only logs people out on subfolder setups at least?

Adicionar caminho ao cookie

Dev

vikaskedia (Vikas Kedia) Março 29, 2018, 10:44pm 35

Please close this issue. It works now. By setting the DISCOURSE_TOKEN_COOKIE env var.

Thanks @Falco @neil

Well done !!

5 curtidas

Tópico		Respostas	Visualizações
Serve Discourse from a subfolder (path prefix) instead of a subdomain Self-Hosting docker , subfolder , how-to , advanced-setup	29	43077	8 de Janeiro de 2025
Setting the session token '_t' on the entire domain, not just my subdomain Dev	6	5424	1 de Maio de 2016
Address Bar changes under subfolder Support	1	457	28 de Junho de 2020
Put discourse on a sub url Support	6	1401	7 de Agosto de 2020
Generals Subfolder recommendations and tips Self-hosting	9	2048	12 de Janeiro de 2020

Adicionar caminho ao cookie

Tópicos relacionados