Reverse Proxy doesn't set path of auth cookie

[patrickpichler]

Describe the problem

The cookie set by the auth control of the reverse proxy is missing the Path options (src). According to MDN if the path is omitted, the browser will fill in the path component of the request URL (docs).

This causes issues with services such as Immichs share feature, as the share URL will look like example.com/share/aaabbcccc, but when opening it, it will also try to load resources from example.com/_app/xyz. Since the cookie is set with path /share, the requests to /_app will fail with 401.

To Reproduce

Steps to reproduce the behavior:

1. Host some kind of webserver (for example this dummy one using ncat: while true ; do ncat -l -p 1500 -c 'echo "HTTP/1.1 200 OK\n\n $(date)"'; done)
2. Expose it as a reverse proxy service protected by authentication
3. Navigate to /hello/world and authenticate
4. Navigate to /foo/bar and observe that you need to authenticate again

Expected behavior

Authentication should only happen once.

Are you using NetBird Cloud?

NetBird Cloud

NetBird version

0.65.3

Is any other VPN software installed?

No

Have you tried these troubleshooting steps?

• Reviewed client troubleshooting (not applicable)
• Checked for newer NetBird versions
• Searched for similar issues on GitHub (including closed ones)
• Restarted the NetBird client
• Disabled other VPN software
• Checked firewall settings

[patrickpichler]

I think the following patch should fix the issue, I didn't have time to fully test it yet though 🙂

diff --git a/proxy/internal/auth/middleware.go b/proxy/internal/auth/middleware.go
index 670cafb6..31c301d6 100644
--- a/proxy/internal/auth/middleware.go
+++ b/proxy/internal/auth/middleware.go
@@ -417,6 +417,7 @@ func setSessionCookie(w http.ResponseWriter, token string, expiration time.Durat
 		Secure:   true,
 		SameSite: http.SameSiteLaxMode,
 		MaxAge:   int(expiration.Seconds()),
+		Path:     "/",
 	})
 }

[vldmr-k]

@patrickpichler I got the same problem, after password/sso auth I see in the browser session path

/init-url

Instead of

/

And when I change url from /first-url to / everything is good.

So, your patch is in PR or it your local hack?

[patrickpichler]

I didn't open a PR yet, as I didn't have time to fully test it. At least in theory it should fix the issue. I am not sure if I have time today to test the change, so if you have a local dev setup to quickly test this, feel free to copy the patch 😅