diff --git a/internal/outpost/proxyv2/application/session.go b/internal/outpost/proxyv2/application/session.go index 55d2bbb46..f89f0315a 100644 --- a/internal/outpost/proxyv2/application/session.go +++ b/internal/outpost/proxyv2/application/session.go @@ -50,6 +50,7 @@ func (a *Application) getStore(p api.ProxyOutpostConfig, externalHost *url.URL) Domain: *p.CookieDomain, SameSite: http.SameSiteLaxMode, MaxAge: maxAge, + Path: externalHost.Path, }) a.log.Trace("using redis session backend") @@ -66,11 +67,11 @@ func (a *Application) getStore(p api.ProxyOutpostConfig, externalHost *url.URL) // Note, when using the FilesystemStore only the session.ID is written to a browser cookie, so this is explicit for the storage on disk cs.MaxLength(math.MaxInt) cs.Options.HttpOnly = true - if strings.ToLower(externalHost.Scheme) == "https" { - cs.Options.Secure = true - } + cs.Options.Secure = strings.ToLower(externalHost.Scheme) == "https" cs.Options.Domain = *p.CookieDomain cs.Options.SameSite = http.SameSiteLaxMode + cs.Options.MaxAge = maxAge + cs.Options.Path = externalHost.Path a.log.WithField("dir", dir).Trace("using filesystem session backend") return cs }