From 426c99296df290e70766921d4d7dac3b84f49a8b Mon Sep 17 00:00:00 2001 From: Sam Rolfe Date: Sat, 8 Aug 2026 15:23:40 +1000 Subject: [PATCH] auth: shared session cookie domain (SESSION_COOKIE_DOMAIN) so apex + www stay logged in --- frontend/internal/auth/session.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/frontend/internal/auth/session.go b/frontend/internal/auth/session.go index 4b3bf94..9a2b548 100644 --- a/frontend/internal/auth/session.go +++ b/frontend/internal/auth/session.go @@ -2,6 +2,7 @@ package auth import ( "net/http" + "os" "github.com/gorilla/sessions" ) @@ -13,6 +14,8 @@ const SessionName = "ww_session" var Store *sessions.CookieStore // InitSessionStore creates the cookie store with the server secret. +// SESSION_COOKIE_DOMAIN (optional) shares the session across subdomains, +// e.g. ".where-woof.com" so apex + www both see the login. func InitSessionStore(secret string) { Store = sessions.NewCookieStore([]byte(secret)) Store.Options = &sessions.Options{ @@ -21,6 +24,9 @@ func InitSessionStore(secret string) { SameSite: http.SameSiteLaxMode, MaxAge: 30 * 24 * 3600, // 30 days } + if d := os.Getenv("SESSION_COOKIE_DOMAIN"); d != "" { + Store.Options.Domain = d + } } // GetUserID returns the authenticated user id from the request, if any.