Skip to content

Conversation

@d-masson
Copy link
Contributor

@d-masson d-masson commented Mar 30, 2021

When using cookie lb_policy, the cookie sent doesn't contain a path. So the path of the cookie stored by the browser is the url path

For exemple with this Caddyfile:

{
 debug
 admin localhost:2010
 auto_https disable_redirects
}
http://localhost:8443 {
    respond "B"
}
http://localhost:8444 {
    respond "C"
}
http://localhost:8442 {
    reverse_proxy /* {
        to http://localhost:8443 http://localhost:8444
        lb_policy cookie 
    }
}
  1. When using url http://localhost:8442/A/B/C, caddy send a cookie without path and this cookie is stored in the browser with the path /A/B
  2. When the same brower try to reach url http://localhost:8442/A/E/D, the browser doesn't send the first cookie (as the path doesn't match), so the server is sending a new cookie without path, the stickyness is no more guarantee and the browser store the same cookie a second time with a different path (/A/E)

=> We should always send the path / in the cookie

@d-masson d-masson marked this pull request as ready for review March 30, 2021 17:33
@francislavoie francislavoie added this to the v2.4.0 milestone Mar 30, 2021
@francislavoie
Copy link
Member

This is a followup to #3809

Thanks!

@mholt mholt added the bug 🐞 Something isn't working label Mar 30, 2021
@mholt mholt merged commit bd357bf into caddyserver:master Mar 30, 2021
@mholt
Copy link
Member

mholt commented Mar 30, 2021

Thanks for the proactive fix!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug 🐞 Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants