Skip to content

fix(workspace): do not hardcode the workspace cookie domain #589

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
thereisnotime wants to merge 2 commits into
base: develop
Choose a base branch
from
+14 −1
Open

fix(workspace): do not hardcode the workspace cookie domain #589

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0b625cc
fix(workspace): do not hardcode the workspace cookie domain
thereisnotime Aug 3, 2026
0404b02
ci(agent-smoke): skip job when E2E_WS_TOKEN is absent
thereisnotime Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/agent-e2e-smoke.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,8 @@ jobs:
# ubuntu: the fast per-PR gate. The earlier claude hang was MCP-mode's
# MCP-server subprocess (not a platform issue) — the smoke now runs the agent
# in skills mode (no MCP), which works on Linux.
# Fork PRs do not receive secrets so E2E_WS_TOKEN is empty; skip rather than fail.
if: ${{ env.E2E_WS_TOKEN != '' }}
runs-on: ubuntu-latest
timeout-minutes: 25
steps:
Expand Down
13 changes: 12 additions & 1 deletion workspace/frontend/app/[workspaceId]/page.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,20 @@ function WorkspaceLoadingSplash() {
);
}

// Share the cookie across openagents.org subdomains, but fall back to a
// host-only cookie anywhere else. A browser silently drops a cookie whose
// Domain attribute it is not a member of, so hardcoding the attribute means no
// cookie at all on a self-hosted deployment.
function workspaceCookieDomain(hostname: string): string {
return hostname === 'openagents.org' || hostname.endsWith('.openagents.org')
? ';domain=.openagents.org'
: '';
}

function setWorkspaceCookie(slug: string, token: string) {
const maxAge = 30 * 24 * 60 * 60;
const shared = `path=/;max-age=${maxAge};secure;samesite=lax;domain=.openagents.org`;
const domain = workspaceCookieDomain(window.location.hostname);
const shared = `path=/;max-age=${maxAge};secure;samesite=lax${domain}`;
document.cookie = `oa_workspace=${encodeURIComponent(JSON.stringify({ slug, token }))};${shared}`;
document.cookie = `oa_has_workspace=1;${shared}`;
}
Expand Down
Loading