@sam I took your suggestion … deleted all the cookies and I still hit the bug.
Please see the attached video:
I can go back and forth between two sites at the same domain, different subfolders, and I don’t see anything out of the ordinary hitting the auth logs.
6 - seen token
5 - rotate
4 - seen token
3 - rotate
...
Those don’t happen very often.
@neil I can give you access to my system remotely if it helps you debug.
I am able to replicate the bug in the video every time.
I believe you, but subfolder debugging… ugh. Still working on it.
So you deleted your cookies but still have the problem?
yes … I wanted to make sure I did it … so I also recorded it in the video
Hmm, the problem definitely goes away for me when i’ve cleared cookies. Do yours look like this now?
I reverted the other fix, so you should undo that change since it’s worse behaviour than before. I don’t understand what you’re seeing, or how to fix what I’m seeing.
maybe its time for big boss @sam to step in !!
We are deferring on this for now. Running two instances of Discourse on the same domain in different subfolders is not a supported config at the moment. We may circle back to this in a few months, though.
makes sense … being able to say 'No" creates a great product.
We will give another go at this soon.
3 Likes
Please close this issue. It works now. By setting the DISCOURSE_TOKEN_COOKIE env var.
Well done !!
5 Likes
As @vikaskedia mentioned earlier, there is a workaround. You can use a different cookie name for each subfolder by using DISCOURSE_TOKEN_COOKIE in your configuration.
However, there is still a bug here where cookies are not properly restricted to paths on subfolder installs, causing conflicts with their sessions. The only solution is to use a different cookie name for now.
A better fix from a security standpoint would be to restrict to the proper subfolder path per cookie.
4 Likes
Can you scope how much work this would be, in terms of “T-shirt sizing”? Small, Medium, Large, XL, XXL?
Somewhere between small and medium. It would log everyone off though when “fixed / changed”
2 Likes
Hmm that is fairly traumatic. Is there any way to fix it so it only logs people out on subfolder setups at least?