OIDC Cookie Domain Scoping Issue (follow-up to #1740) #549

New Issue

MrUnknownDE · 2026-04-05T17:18:32+02:00

MrUnknownDE commented

2026-04-05 17:18:32 +02:00

Originally created by @88plug on 12/6/2025

Describe the Bug

OIDC cookies are set with incorrect domain scope, breaking authentication across subdomains using default configuration.

This is a follow-up to #1740 which was closed as stale/not planned, but the issue persists with default settings.

When using OIDC authentication (e.g., Authentik, Keycloak) with resources on subdomains - with NO custom cookie configuration:

p_oidc_state cookie is set with Domain=resource1.example.com instead of .example.com
After the OIDC provider redirects back to the Pangolin base URL (pangolin.example.com), the browser refuses to send the cookie due to domain mismatch
SameSite=lax (the default) further blocks the cookie on cross-site redirects
p_session_token is also scoped to exact hostname, causing redirect loops

This occurs out-of-the-box with a standard multi-subdomain setup. No non-default cookie settings were configured. The root cause is that Pangolin's default cookie domain scoping doesn't account for
subdomain usage, which is the primary use case for a reverse proxy.

Environment

OS Type & Version: Ubuntu 24.04 LTS
Pangolin Version: 1.12.x (latest)
Gerbil Version: latest
Traefik Version: v3.4
Newt Version: N/A
Olm Version: N/A
Configuration: DEFAULT (no custom cookie settings)

To Reproduce

Install Pangolin using default configuration (official installer or docker-compose)
Configure an OIDC provider (e.g., Authentik) - standard setup per docs
Create a resource accessible at resource1.example.com
Pangolin dashboard at pangolin.example.com
Do NOT modify any cookie-related settings - use defaults
Attempt to access resource1.example.com which requires OIDC auth
Observe that p_oidc_state cookie is set with Domain=resource1.example.com
OIDC provider authenticates and redirects to pangolin.example.com
Browser does not send the cookie (domain mismatch + SameSite=lax)
Authentication fails or enters a redirect loop

No workarounds or custom configuration applied - this is purely default behavior.

Expected Behavior

With default configuration, OIDC-related cookies (p_oidc_state, p_session_token) should be set with first-level domain scope:

Domain=.example.com (note the leading dot)
This allows cookies to be shared across all subdomains by default
SameSite attribute should be appropriate for OIDC redirect flows out-of-the-box

A reverse proxy serving multiple subdomains is the standard use case - cookie scoping should work correctly without requiring manual intervention or third-party plugins.

Current workaround requires Traefik's proxy-cookie plugin to rewrite cookie domains, but this should not be necessary with sensible defaults.

*Originally created by @88plug on 12/6/2025* ### Describe the Bug OIDC cookies are set with incorrect domain scope, breaking authentication across subdomains using default configuration. This is a follow-up to #1740 which was closed as stale/not planned, but the issue persists with default settings. When using OIDC authentication (e.g., Authentik, Keycloak) with resources on subdomains - with NO custom cookie configuration: 1. `p_oidc_state` cookie is set with `Domain=resource1.example.com` instead of `.example.com` 2. After the OIDC provider redirects back to the Pangolin base URL (`pangolin.example.com`), the browser refuses to send the cookie due to domain mismatch 3. `SameSite=lax` (the default) further blocks the cookie on cross-site redirects 4. `p_session_token` is also scoped to exact hostname, causing redirect loops This occurs out-of-the-box with a standard multi-subdomain setup. No non-default cookie settings were configured. The root cause is that Pangolin's default cookie domain scoping doesn't account for subdomain usage, which is the primary use case for a reverse proxy. ### Environment - OS Type & Version: Ubuntu 24.04 LTS - Pangolin Version: 1.12.x (latest) - Gerbil Version: latest - Traefik Version: v3.4 - Newt Version: N/A - Olm Version: N/A - Configuration: DEFAULT (no custom cookie settings) ### To Reproduce 1. Install Pangolin using default configuration (official installer or docker-compose) 2. Configure an OIDC provider (e.g., Authentik) - standard setup per docs 3. Create a resource accessible at `resource1.example.com` 4. Pangolin dashboard at `pangolin.example.com` 5. Do NOT modify any cookie-related settings - use defaults 6. Attempt to access `resource1.example.com` which requires OIDC auth 7. Observe that `p_oidc_state` cookie is set with `Domain=resource1.example.com` 8. OIDC provider authenticates and redirects to `pangolin.example.com` 9. Browser does not send the cookie (domain mismatch + SameSite=lax) 10. Authentication fails or enters a redirect loop No workarounds or custom configuration applied - this is purely default behavior. ### Expected Behavior With default configuration, OIDC-related cookies (`p_oidc_state`, `p_session_token`) should be set with first-level domain scope: - `Domain=.example.com` (note the leading dot) - This allows cookies to be shared across all subdomains by default - `SameSite` attribute should be appropriate for OIDC redirect flows out-of-the-box A reverse proxy serving multiple subdomains is the standard use case - cookie scoping should work correctly without requiring manual intervention or third-party plugins. Current workaround requires Traefik's proxy-cookie plugin to rewrite cookie domains, but this should not be necessary with sensible defaults.

MrUnknownDE closed this issue

2026-04-05 17:18:32 +02:00

MrUnknownDE added the stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale labels 2026-04-05 17:18:33 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#549