fix SSO cookie rewrite in site proxy: fleet-wide (Domain=) cookies scope to /site/, strip Secure for http loopback

8ef170b6d6678a31df3b05c55fe442896a5910b2 · 2026-07-22 19:15:59 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 8ef170b6d6678a31df3b05c55fe442896a5910b2
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Jul 22 19:15:59 2026 -0700

    fix SSO cookie rewrite in site proxy: fleet-wide (Domain=) cookies scope to /site/, strip Secure for http loopback
---
 server.js | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/server.js b/server.js
index 6178306..d3cb1e6 100644
--- a/server.js
+++ b/server.js
@@ -106,8 +106,17 @@ const server = http.createServer(async (req, res) => {
         } catch {}
       }
       if (h['set-cookie']) {
-        h['set-cookie'] = h['set-cookie'].map((c) =>
-          c.replace(/;\s*Domain=[^;]+/gi, '').replace(/;\s*Path=\//i, `; Path=/site/${domain}/`));
+        h['set-cookie'] = h['set-cookie'].map((c) => {
+          // A Domain= attribute means the cookie is cross-subdomain (e.g. the
+          // aafleet SSO cookie, Domain=.agentabrams.com) — scope it to /site/ so
+          // it follows the user across every proxied domain, not just the setter.
+          const fleetWide = /;\s*Domain=/i.test(c);
+          return c
+            .replace(/;\s*Domain=[^;]+/gi, '')
+            // Viewer is served over plain http on loopback; Safari drops Secure cookies there.
+            .replace(/;\s*Secure/gi, '')
+            .replace(/;\s*Path=\/([^;]*)/i, fleetWide ? '; Path=/site/' : `; Path=/site/${domain}/$1`);
+        });
       }
       res.writeHead(pres.statusCode, h);
       pres.pipe(res);

← 02f58ea viewer: credential-injecting reverse proxy so unified admin · back to Agentabrams Viewer · chore: lint, refactor (dedup loadDomains, proxy-error writab 4175e4a →