Cross-domain cookies on preview
amethystix
PROOP

4 months ago

So our team is working on an auth service that stores session cookies on our subdomain. Preview environments are pretty impossible for us to test right now though, since we can't set subdomain cookies on .up.railway.app

Any suggestions? This is pretty frustrating since I'm not sure how we should be testing auth, or signing into our preview instances that are gated using it.

$30 Bounty

22 Replies

More context? You would want to test session cookies in a PR env?


amethystix
PROOP

4 months ago

Our auth service is hosted on railway as a fullstack app with tanstack start. It deploys with preview environments since it's needed to log in to our other apps.

I'm using Better Auth where I have a session cookie that normally exists on our application's dedicated subdomain. We have several applications that will be using the same subdomain.

I might be able to doubly set the cookie on both domains, but that really wouldn't be ideal. but because up.railway.app is listed under public suffixes, I cannot set cross domain cookies on it. (side note….I know it's not great to be setting cookies on such a public domain, but since they're throwaway test accounts we weren't really minding it)


We do that for staging

But! The ask really is for root domains for PR envs right?


You'd really want:

pr-0937093.yourapp.com

where the subdomain is arbirtrarily generated by Railway yea?


ofc, we have a separate domain for it and everything, but we hack around it


amethystix
PROOP

4 months ago

Yep, exactly! I upvoted it on the roadmap, but right now have just been struggling to find a good way around it without over-engineering for my preview envs


I regret to inform you that this isn't an easy lift


and the PR env networking is a codepath full of spider webs

I mean it works, and it's reliable but if you can prove to us that it's blocking some real $$$ its hard for me to get it reprioritized.


Wait- looked at your account


You are indeed Enterprise


Okay, lemme add this to your account notes, Rahul (your AE) will pull some strings to get us to think about this.


amethystix
PROOP

4 months ago

Totally understand! Networking certainly is not an easy problem to solve in general 😂


amethystix
PROOP

4 months ago

I appreciate it though! Honestly I am just struggling to think about how to get this to work reliably, was mostly hoping that potentially someone had run into a similar use case and solved for it


We may have some parallel threads, I think we would want us to move away from the CNAME flattening system we have, if we move from that- other things become significantly easier.


amethystix
PROOP

4 months ago

Honestly even having a custom subdomain string on the railway domain that's just for our org would be nice- something like:
pr-123.tonohealth.up.railway.app

but yeah, not sure how complicated that would be for y'all to implement 🙂 I will think on some workarounds, might need to just proxy some requests and forward my cookie headers for now


custom subdomain string

This is actually much easier


I will take it to the lab.


amethystix
PROOP

4 months ago

Awesome to hear! Thank you, really appreciate it


amethystix
PROOP

4 months ago

Hey! Just wanted to bump this because I'm curious- what can we look for in terms of turnaround time for something like this? Even if it's just an estimate of when you might get around to it


amethystix
PROOP

4 months ago

@angelo gentle ping when you get the chance!


Ack. Not likely at all that we can pick this up this quarter; no spare cycles.


princed
PRO

3 months ago

I appreciate it though! Honestly I am just struggling to think about how to get this to work reliably, was mostly hoping that potentially someone had run into a similar use case and solved for it

Definitely struggling with this too, here's what I settled on as a workaround:

  1. Few lines of frontend code that check whether we're on <pr-preview>.up.railway.app and redirect to <pr-preview>.custom.domain if yes

  1. A Railway function that listens on <pr-preview>.custom.domain and proxies back to <pr-preview>.up.railway.app

  2. Depending on your setup you might need something similar to 1. on your backend to rewrite CORS headers


Loading...