From 847edff1f8ce06bf91619380d2c9ea030bee258f Mon Sep 17 00:00:00 2001 From: ginnoir Date: Wed, 24 Jun 2026 15:30:14 -0500 Subject: [PATCH] fix(proxy): SameSite=Lax on share_gate cookie to fix Safari/Firefox redirect SameSite=Strict caused Safari and Firefox to drop the freshly-set cookie on the immediate same-site redirect when the top-level navigation originated from an external app (Discord). SameSite=Lax explicitly permits the cookie on same-site redirects regardless of the initiating context. Co-Authored-By: Claude Sonnet 4.6 --- Caddyfile | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/Caddyfile b/Caddyfile index a0d8e59..9272491 100644 --- a/Caddyfile +++ b/Caddyfile @@ -39,15 +39,17 @@ # Shared-link gate — external users visit ?k= once to get a 30-day cookie. # Internal IPs and tailnet clients pass through unconditionally. # Usage: import share_gate (replaces import internal_only on shared services) -# Uses {$SHARE_KEY} (parse-time substitution) — baked in at caddy reload/start when the -# env var is set. Rotate: update SHARE_KEY in stack.env, push → Portainer redeploys → key changes. +# Uses {$SHARE_KEY} (parse-time substitution) — baked in at caddy reload/start. +# SameSite=Lax (not Strict): Strict causes Safari/Firefox to drop the cookie on the +# redirect when the top-level navigation originated from an external app (Discord). +# Rotate: update SHARE_KEY in stack.env, push → Portainer redeploys → new key. (share_gate) { @external not remote_ip 192.168.1.0/24 172.16.0.0/12 100.64.0.0/10 127.0.0.1 handle @external { route { @has_key query k={$SHARE_KEY} handle @has_key { - header Set-Cookie "share_access={$SHARE_KEY}; Path=/; Max-Age=2592000; HttpOnly; Secure; SameSite=Strict" + header Set-Cookie "share_access={$SHARE_KEY}; Path=/; Max-Age=2592000; HttpOnly; Secure; SameSite=Lax" redir {http.request.uri.path} 302 } @has_cookie expression `{http.request.cookie.share_access} == "{$SHARE_KEY}"`