search

Graylog2 / graylog2-server

Free and open log management
https://www.graylog.org
Other
7.4k stars 1.07k forks source link

Disable posthog cross_subdomain_cookie in Self-Managed setup #15675

Open zhu opened 1 year ago

zhu commented 1 year ago

Posthog enable cross_subdomain_cookie by default, set the cookie on the top level domain.

Expected Behavior

cookie only set on the subdomain (graylog.example.com)

Current Behavior

cookie set on top level domain (example.com)

Possible Solution

Steps to Reproduce (for bugs)

1. 2. 3. 4.

Context

Your Environment

utahbmxer commented 11 months ago

Any updates on this? Landed here because I discovered after update to Graylog5, this cookie is causing subdomains to be blocked in my NGINX waf.

  1. Log into nextcloud.domain.com, browse around and it works fine.
  2. Log into graylog.domain.com
  3. Now nextcloud is blocked in my waf because request headers from posthog/Graylog (.domain.com) are sent to nextcloud.domain.com
  4. Shift+F9, delete posthog Cookie and nextcloud starts working again.

Thanks!