Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Logout does not use new cookie domain setting #645

Closed
wezzle opened this issue Aug 10, 2020 · 1 comment
Closed

Logout does not use new cookie domain setting #645

wezzle opened this issue Aug 10, 2020 · 1 comment
Labels
bug Something is not working.

Comments

@wezzle
Copy link
Contributor

wezzle commented Aug 10, 2020

Describe the bug

The browser logout flow does not use the newly configurable cookie domain added in #516. I'm guessing the domain and path options should be correctly set for new cookies in this file:
https://github.com/ory/kratos/blob/master/driver/registry_default.go#L369

The options set in the following file do not seem to be persisted in the gorilla/session's store:
https://github.com/ory/kratos/blob/master/session/manager_http.go#L66

On browser flow login the session.Options are as followed:
&{Path:/ Domain:.happyitaly.localhost MaxAge:3600 Secure:false HttpOnly:true SameSite:2}

On browser flow logout they are as followed:
&{Path:/ Domain: MaxAge:2592000 Secure:false HttpOnly:true SameSite:0}

The max age is then overwritten by: https://github.com/ory/kratos/blob/master/session/manager_http.go#L120

Reproducing the bug

Steps to reproduce the behavior:

  1. Set custom cookie domain to .domain.com (notice the . so it is readable for all subdomains)
  2. Start the logout flow
  3. See the Set-Cookie header in the network panel, notice the wrong Domain

Expected behavior

Cookie domain is set correctly so logout works.

Environment

  • Version: c13b183
  • Environment: Docker
@fenix01
Copy link

fenix01 commented Aug 10, 2020

Hi,

I was going to post a similar issue. I have the same bug with the logout flow. It doesn't set the Domain for the cookie.
I was on the master branch (commit: b724038)

@aeneasr aeneasr added the bug Something is not working. label Aug 10, 2020
@aeneasr aeneasr added this to the v0.5.0-alpha.1 milestone Aug 10, 2020
@aeneasr aeneasr closed this as completed in 6d77e04 Sep 1, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something is not working.
Projects
None yet
Development

No branches or pull requests

3 participants