greeneclipse/descrybe
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add SESSION_COOKIE_DOMAIN so /admin SSR sees the session cookie

Browse Source 
Production splits web (descrybe.io) and API (api.descrybe.io). The session
cookie was host-only for api.descrybe.io, so the browser never sent it to
the web host. The /admin SvelteKit SSR gate (fetchMeStaff in
+layout.server.ts) forwards the incoming cookie header to /api/auth/me —
with no cookie to forward it always got 401 and bounced every successful
login back to /login?next=/admin (login POST 200, /me 200 from the
browser, /me 401 from the web server).

New SESSION_COOKIE_DOMAIN env (default empty = host-only, local dev
unchanged) sets the session cookie Domain attribute; set it to the parent
domain (descrybe.io) in production so both hosts receive the cookie.
Leading dot is normalized away. CSRF needs no change — it already seeds
cross-origin via the X-CSRF-Token response header.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
greeneclipse
2026-08-18 00:31:58 +02:00
co-authored by Claude Fable 5
parent b595398389
commit 0eef202f56
6 changed files with 35 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+6
View File
@@ -105,6 +105,12 @@ APP_ENCRYPTION_KEY=
# Optional RATE_LIMIT_REPLICAS divides HTTP middleware caps only (not lockout/StartLimiter/AI/email)
# — not a shared store. RATE_LIMIT_BACKEND=redis|postgres is docs-only and forced to memory.
# SESSION_COOKIE_NAME=descrybe_session
# Session cookie Domain attribute. Empty = host-only (localhost / same-host).
# REQUIRED when web + api run on sibling subdomains (descrybe.io + api.descrybe.io):
# set the parent domain so the browser also sends the session cookie to the web
# host — SvelteKit SSR gates (/admin) forward it to /api/auth/me and otherwise
# always see 401 (login loops back to /login?next=...).
# SESSION_COOKIE_DOMAIN=descrybe.io
# CSRF_COOKIE_NAME=descrybe_csrf
# PUBLIC_CSRF_COOKIE_NAME=descrybe_csrf
# SESSION_IDLE_HOURS=24