You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I was going to post a similar issue. I have the same bug with the logout flow. It doesn't set the Domain for the cookie.
I was on the master branch (commit: b724038)
Describe the bug
The browser logout flow does not use the newly configurable cookie domain added in #516. I'm guessing the domain and path options should be correctly set for new cookies in this file:
https://github.com/ory/kratos/blob/master/driver/registry_default.go#L369
The options set in the following file do not seem to be persisted in the gorilla/session's store:
https://github.com/ory/kratos/blob/master/session/manager_http.go#L66
On browser flow login the session.Options are as followed:
&{Path:/ Domain:.happyitaly.localhost MaxAge:3600 Secure:false HttpOnly:true SameSite:2}
On browser flow logout they are as followed:
&{Path:/ Domain: MaxAge:2592000 Secure:false HttpOnly:true SameSite:0}
The max age is then overwritten by: https://github.com/ory/kratos/blob/master/session/manager_http.go#L120
Reproducing the bug
Steps to reproduce the behavior:
.domain.com
(notice the.
so it is readable for all subdomains)Set-Cookie
header in the network panel, notice the wrongDomain
Expected behavior
Cookie domain is set correctly so logout works.
Environment
The text was updated successfully, but these errors were encountered: