StreamedResponse is responding cookies of the requested domain, and not the SESSION_DOMAIN

Hi:

In my backoffice pages, there's some Streamed responses

return response()->stream(function () {

I've checked this requests sends again the cookies of the session (the one defined in config.session.config), and the xsrf-token again ... but with a glitch: changing the domain !!

Instead of using the domain defined in config.session.domain, it use the one of the request itself.

My problem is that the config.session.domain I have is .mydomain.com (since I use it for that domain and all subdomains), but my backoffice is in backoffice.mydomain.com.

When some StreamResponse is used, it created, as I said, the cookies for backoffice.mydomain.com

Therefore I have four cookies:

session one for .mydomain.com
xsrf-token for .mydomain.com
session one for .backoffice.mydomain.com
xsrf-token for .backoffice.mydomain.com

And that generates a problem for login actions ... sometimes, users complaints that they can not login properly (the login page goes to login page without log-in successfully), and it's working again, when I request them to delete the cookie session for .backoffice.mydomain.com

So, it's like having two cookie sessions with domain.com and sub.domain.com causes problems.

So:

How can I fix this ?
Why StreamResponse is sending cookies with the request domain and not with the session cookie domain ?
How can I prevent this in a MiddleWare ? I tried this but it's not working

            if ($response instanceof \Symfony\Component\HttpFoundation\StreamedResponse) {
                \Config::set('session.driver', 'array');
                \Config::set('cookie.driver', 'array');
            }

Thank you !

LaryAI

3 years ago

Level 58

The issue is likely caused by the fact that the StreamedResponse is not using the same session driver as the rest of your application. To fix this, you can set the session driver to the same one as the rest of your application in the StreamedResponse. For example, if you are using the file session driver, you can set it like this:

if ($response instanceof \Symfony\Component\HttpFoundation\StreamedResponse) {
    \Config::set('session.driver', 'file');
    \Config::set('cookie.driver', 'file');
}

This should ensure that the StreamedResponse is using the same session driver as the rest of your application, and the cookies should be set with the correct domain.

skater

3 years ago

Level 1

@LaryAI First of all, thank you !!!

I've tried and that Stream request is sending yet the session cookie in the sub.domain.com I've tried with database, null, file ... I've checked (using \Config::get) to check if StreamResponse is using the same driver than my app, and yes ... they are using both "database"

but also... is it normal StreamResponse requests send different cookies by default? why? Why in Laravel they don't take the config.session.domain ?

and also ... the login crash behaviour having those 2 cookies is normal ? I mean ... Does it make sense that Laravel does not work when you have two cookies with the same name in domain.com and sub.domain.com ?

Please or to participate in this conversation.