Skip to content

Commit 44602cc

Browse files
committed
Add base back to login page
This is used to set cookies when using a base path.
1 parent 7a52cb8 commit 44602cc

File tree

2 files changed

+14
-1
lines changed

2 files changed

+14
-1
lines changed

src/browser/pages/login.html

+9
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ <h1 class="main">Welcome to code-server</h1>
3030
<div class="content">
3131
<form class="login-form" method="post">
3232
<input class="user" type="text" autocomplete="username" />
33+
<input id="base" type="hidden" name="base" value="/" />
3334
<div class="field">
3435
<input
3536
required
@@ -47,5 +48,13 @@ <h1 class="main">Welcome to code-server</h1>
4748
</div>
4849
</div>
4950
</div>
51+
<script>
52+
// Inform the backend about the path since the proxy might have rewritten
53+
// it out of the headers and cookies must be set with absolute paths.
54+
const el = document.getElementById("base")
55+
if (el) {
56+
el.value = window.location.pathname
57+
}
58+
</script>
5059
</body>
5160
</html>

src/node/routes/login.ts

+5-1
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,11 @@ router.post("/", async (req, res) => {
8888
// obfuscation purposes (and as a side effect it handles escaping).
8989
res.cookie(Cookie.Key, hashedPassword, {
9090
domain: getCookieDomain(req.headers.host || "", req.args["proxy-domain"]),
91-
path: req.body.base || "/",
91+
// Browsers do not appear to allow cookies to be set relatively so we
92+
// need to get the root path from the browser since the proxy rewrites
93+
// it out of the path. Otherwise code-server instances hosted on
94+
// separate sub-paths will clobber each other.
95+
path: req.body.base ? path.posix.join(req.body.base, "..") : "/",
9296
sameSite: "lax",
9397
})
9498

0 commit comments

Comments
 (0)