From 2200ff657a0efc64c8a712f923c17f139eeb4389 Mon Sep 17 00:00:00 2001 From: cclohmar Date: Mon, 15 Jun 2026 06:44:10 +0000 Subject: [PATCH] fix(auth): set cookie domain for cross-subdomain OIDC flow --- src/core/auth/oidc.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/core/auth/oidc.go b/src/core/auth/oidc.go index 4a834e5..beae26f 100644 --- a/src/core/auth/oidc.go +++ b/src/core/auth/oidc.go @@ -43,11 +43,12 @@ func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) { verifier := generateToken(32) challenge := pkceChallenge(verifier) - // Store state + verifier in cookies + // Store state + verifier in cookies (shared across subdomains) http.SetCookie(w, &http.Cookie{ Name: "oidc_state", Value: state, Path: "/", + Domain: h.config.Domain, MaxAge: 300, HttpOnly: true, SameSite: http.SameSiteLaxMode, @@ -56,6 +57,7 @@ func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) { Name: "oidc_verifier", Value: verifier, Path: "/", + Domain: h.config.Domain, MaxAge: 300, HttpOnly: true, SameSite: http.SameSiteLaxMode, @@ -132,6 +134,7 @@ func (h *OIDCHandler) Callback(w http.ResponseWriter, r *http.Request) { Name: "nextwks_session", Value: token, Path: "/", + Domain: h.config.Domain, MaxAge: 3600, HttpOnly: true, SameSite: http.SameSiteStrictMode,