Skip to content

Fix cross-domain cookie handling and domain rebinding#1553

Merged
Eugeny merged 13 commits intowarp-tech:mainfrom
SteezyCougar:fix-cross-domain
Dec 18, 2025
Merged

Fix cross-domain cookie handling and domain rebinding#1553
Eugeny merged 13 commits intowarp-tech:mainfrom
SteezyCougar:fix-cross-domain

Conversation

@SteezyCougar
Copy link
Copy Markdown
Contributor

@SteezyCougar SteezyCougar commented Oct 31, 2025 •
edited
Loading

This PR fixes cross-domain cookie handling and improves domain rebinding functionality for HTTP targets.

1. Cross-Domain Cookie Support

  • Session cookies now work across subdomains of the configured base host (e.g., warpgate.example.com and foo.warpgate.example.com)
  • Cookies are automatically scoped to the base domain with appropriate Secure and SameSite=None attributes for HTTPS
  • Added validation to ensure session cookies only work for the base host and its subdomains, providing security boundaries

2. Domain Rebinding Improvements

  • When HTTP targets have external_host configured, visiting that domain automatically routes to the bound target
  • Domain rebinding now takes priority over target selection for authenticated users
  • Improved host header detection to work reliably behind proxies

UI Fixes

  • Fixed embedded UI "Home" button to redirect to warpgate home instead of bound domain home (Otherwise it gets confusing for users if you access a resource on a non-matching bound domain)
  • Home button now uses the configured external_host to ensure correct navigation

@SteezyCougar SteezyCougar changed the title Update Cookie Logic, Update Domain Binding Logic Fix cross-domain cookie handling and domain rebinding Oct 31, 2025
@SteezyCougar
Copy link
Copy Markdown
Contributor Author

SteezyCougar commented Oct 31, 2025

@Eugeny I think this one should be ready to review!

@SteezyCougar
Copy link
Copy Markdown
Contributor Author

SteezyCougar commented Nov 5, 2025

I had a previous PR that fixed only part of the issue (I hadn't realized it at the time until we got it deployed out to our users), but this fixes the other part, and also helps with the overall flow of the domain rebound sites. We've had it running for a few days internally and I didn't hear any issues

@SteezyCougar
Copy link
Copy Markdown
Contributor Author

SteezyCougar commented Nov 10, 2025

We've been running this internally with our users since this PR has been opened, and things have been working as expected without issues on this version

Eugeny
Eugeny requested changes Nov 24, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@Eugeny Eugeny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your work and sorry for taking so long to review.

In general, could you please add a few comments outlining the logic of the host/cookie checks? It was a bit hard for me to follow even knowing the code base.

@SteezyCougar
Copy link
Copy Markdown
Contributor Author

SteezyCougar commented Dec 1, 2025

@Eugeny made the changes, deployed them internally, and things seem to still be working

@SteezyCougar
Copy link
Copy Markdown
Contributor Author

SteezyCougar commented Dec 3, 2025

@Eugeny rebased and ready!

@SteezyCougar
Copy link
Copy Markdown
Contributor Author

SteezyCougar commented Dec 8, 2025

@Eugeny hate to be a bother, could I get a bump on this though!

github-advanced-security[bot]
github-advanced-security bot found potential problems Dec 16, 2025
View reviewed changes
@Eugeny Eugeny merged commit 40d4ba3 into warp-tech:main Dec 18, 2025
14 checks passed
@Eugeny
Copy link
Copy Markdown
Member

Eugeny commented Dec 22, 2025

Thank you and sorry for taking so long ✌️

This was referenced Jan 7, 2026
Open
Merged
SteezyCougar added a commit to SteezyCougar/warpgate that referenced this pull request Jan 9, 2026
@SteezyCougar @Eugeny
Fix cross-domain cookie handling and domain rebinding (warp-tech#1553)
139c0fd 
Co-authored-by: Eugene <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Eugeny Eugeny Eugeny requested changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@SteezyCougar @Eugeny @github-advanced-security