quantfortune/SIP_GoldBees_Backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix reconnect broker: share session cookie across subdomains

Browse Source 
Frontend (app.quantfortune.com) fetches API (api.quantfortune.com).
With SameSite=Lax the browser won't send the cookie on cross-origin
fetch calls, so the server sees no session and the request fails.

Adding COOKIE_DOMAIN=.quantfortune.com makes the cookie valid for
all subdomains. Mohan needs to add this to .env and restart.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Thigazhezhilan J 2026-05-20 23:31:46 +05:30
parent 74d8db1de0
commit 02922adc9a
2 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
backend/.env.example
View File

@ -11,6 +11,8 @@ RESET_OTP_SECRET=
# ── Environment ─────────────────────────────────────────────────────────────── # ── Environment ───────────────────────────────────────────────────────────────
APP_ENV=production APP_ENV=production
CORS_ORIGINS=https://quantfortune.com,https://www.quantfortune.com,https://app.quantfortune.com,https://www.app.quantfortune.com CORS_ORIGINS=https://quantfortune.com,https://www.quantfortune.com,https://app.quantfortune.com,https://www.app.quantfortune.com
# Required when frontend and API are on different subdomains (e.g. app. vs api.)
COOKIE_DOMAIN=.quantfortune.com
# ── Database ────────────────────────────────────────────────────────────────── # ── Database ──────────────────────────────────────────────────────────────────
DATABASE_URL=postgresql://user:password@localhost:5432/quantfortune DATABASE_URL=postgresql://user:password@localhost:5432/quantfortune

2
backend/app/routers/auth.py
View File

@ -19,6 +19,7 @@ APP_ENV = (os.getenv("APP_ENV") or os.getenv("ENVIRONMENT") or os.getenv("FASTAP
IS_PRODUCTION = APP_ENV in {"prod", "production"} IS_PRODUCTION = APP_ENV in {"prod", "production"}
COOKIE_SECURE = True if IS_PRODUCTION else os.getenv("COOKIE_SECURE", "0") == "1" COOKIE_SECURE = True if IS_PRODUCTION else os.getenv("COOKIE_SECURE", "0") == "1"
COOKIE_SAMESITE = (os.getenv("COOKIE_SAMESITE") or "lax").lower() COOKIE_SAMESITE = (os.getenv("COOKIE_SAMESITE") or "lax").lower()
COOKIE_DOMAIN = (os.getenv("COOKIE_DOMAIN") or "").strip() or None
if IS_PRODUCTION and not COOKIE_SECURE: if IS_PRODUCTION and not COOKIE_SECURE:
raise RuntimeError("Secure session cookies are mandatory in production") raise RuntimeError("Secure session cookies are mandatory in production")
@ -33,6 +34,7 @@ def _set_session_cookie(response: Response, session_id: str):
max_age=SESSION_TTL_SECONDS, max_age=SESSION_TTL_SECONDS,
secure=COOKIE_SECURE, secure=COOKIE_SECURE,
path="/", path="/",
domain=COOKIE_DOMAIN,
) )