Pangolin does not set proper cookie domain #791

New Issue

MrUnknownDE · 2026-04-05T17:43:34+02:00

MrUnknownDE commented

2026-04-05 17:43:34 +02:00

Originally created by @mihaiblaga89 on 10/9/2025

Describe the Bug

I've configured Pangolin with example.com domain and I've added a resource mapped to a.b.example.com. Pangolin is set to pangolin.example.com. However, the cookie(p_session_token) set by the auth endpoint is set to domain .pangolin.example.com which will not be sent for a.b.example.com and this creates a redirect loop. Pangolin is set to use OIDC provider, in my case Google.

I've dug around the code a bit to check if I can override the domain with maybe an env variable or the config but can't find anything.

Environment

OS Type & Version: Ubuntu 25.04
Pangolin Version: 1.10.3
Gerbil Version: 1.2.1
Traefik Version: 3.5
Newt Version:
Olm Version: (if applicable)

To Reproduce

Create the above mentioned config.

Expected Behavior

I'd expect to be at least able to override the cookie domain, if setting the cookie on FQDN out of the box cannot be done

*Originally created by @mihaiblaga89 on 10/9/2025* ### Describe the Bug I've configured Pangolin with `example.com` domain and I've added a resource mapped to a.b.example.com. Pangolin is set to `pangolin.example.com`. However, the cookie(p_session_token) set by the auth endpoint is set to domain `.pangolin.example.com` which will not be sent for `a.b.example.com` and this creates a redirect loop. Pangolin is set to use OIDC provider, in my case Google. I've dug around the code a bit to check if I can override the domain with maybe an env variable or the config but can't find anything. ![Image](https://github.com/user-attachments/assets/96285b3f-47d4-49eb-9625-d25a7d6de91d) ### Environment - OS Type & Version: Ubuntu 25.04 - Pangolin Version: 1.10.3 - Gerbil Version: 1.2.1 - Traefik Version: 3.5 - Newt Version: - Olm Version: (if applicable) ### To Reproduce Create the above mentioned config. ### Expected Behavior I'd expect to be at least able to override the cookie domain, if setting the cookie on FQDN out of the box cannot be done

MrUnknownDE closed this issue

2026-04-05 17:43:34 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#791