I've configured Pangolin with example.com domain and I've added a resource mapped to a.b.example.com. Pangolin is set to pangolin.example.com. However, the cookie(p_session_token) set by the auth endpoint is set to domain .pangolin.example.com which will not be sent for a.b.example.com and this creates a redirect loop. Pangolin is set to use OIDC provider, in my case Google.
I've dug around the code a bit to check if I can override the domain with maybe an env variable or the config but can't find anything.
Environment
OS Type & Version: Ubuntu 25.04
Pangolin Version: 1.10.3
Gerbil Version: 1.2.1
Traefik Version: 3.5
Newt Version:
Olm Version: (if applicable)
To Reproduce
Create the above mentioned config.
Expected Behavior
I'd expect to be at least able to override the cookie domain, if setting the cookie on FQDN out of the box cannot be done
Originally created by @mihaiblaga89 on GitHub (Oct 9, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1644
### Describe the Bug
I've configured Pangolin with `example.com` domain and I've added a resource mapped to a.b.example.com. Pangolin is set to `pangolin.example.com`. However, the cookie(p_session_token) set by the auth endpoint is set to domain `.pangolin.example.com` which will not be sent for `a.b.example.com` and this creates a redirect loop. Pangolin is set to use OIDC provider, in my case Google.
I've dug around the code a bit to check if I can override the domain with maybe an env variable or the config but can't find anything.
### Environment
- OS Type & Version: Ubuntu 25.04
- Pangolin Version: 1.10.3
- Gerbil Version: 1.2.1
- Traefik Version: 3.5
- Newt Version:
- Olm Version: (if applicable)
### To Reproduce
Create the above mentioned config.
### Expected Behavior
I'd expect to be at least able to override the cookie domain, if setting the cookie on FQDN out of the box cannot be done
I think the bug you're experiencing is the same as #1540. I recently pushed a commit to fix this, but it hasn't been released yet. It doesn't have to do with the cookie, but some other logic related to the auto redirect (you can check my commit). Badger in Traefik is responsible for setting the session cookie for the resource domain.
If you confirm the issue is the same as #1540 I will close this as duplicate.
<!-- gh-comment-id:3386834170 -->
@miloschwartz commented on GitHub (Oct 9, 2025):
I think the bug you're experiencing is the same as #1540. I recently pushed a commit to fix this, but it hasn't been released yet. It doesn't have to do with the cookie, but some other logic related to the auto redirect (you can check my commit). Badger in Traefik is responsible for setting the session cookie for the resource domain.
If you confirm the issue is the same as #1540 I will close this as duplicate.
Seems similar to what I encounter, and I also have "auto provision", so
let's close this and I'll wait for the release, and if it doesn't fix my
issue i will reopen it. Thanks!
On Thu, Oct 9, 2025 at 20:19 Milo Schwartz @.***> wrote:
I think the bug you're experiencing is the same as #1540 https://github.com/fosrl/pangolin/issues/1540. I recently pushed a
commit to fix this, but it hasn't been released yet. It doesn't have to do
with the cookie, but some other logic related to the auto redirect (you can
check my commit). Badger in Traefik is responsible for setting the session
cookie for the resource domain.
<!-- gh-comment-id:3386849719 -->
@mihaiblaga89 commented on GitHub (Oct 9, 2025):
Seems similar to what I encounter, and I also have "auto provision", so
let's close this and I'll wait for the release, and if it doesn't fix my
issue i will reopen it. Thanks!
On Thu, Oct 9, 2025 at 20:19 Milo Schwartz ***@***.***> wrote:
> *miloschwartz* left a comment (fosrl/pangolin#1644)
> <https://github.com/fosrl/pangolin/issues/1644#issuecomment-3386834170>
>
> I think the bug you're experiencing is the same as #1540
> <https://github.com/fosrl/pangolin/issues/1540>. I recently pushed a
> commit to fix this, but it hasn't been released yet. It doesn't have to do
> with the cookie, but some other logic related to the auto redirect (you can
> check my commit). Badger in Traefik is responsible for setting the session
> cookie for the resource domain.
>
> If you confirm the issue is the same as #1540
> <https://github.com/fosrl/pangolin/issues/1540> I will close this as
> duplicate.
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/fosrl/pangolin/issues/1644#issuecomment-3386834170>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/ABEQ5OUWXBUNC6MFALHXIKD3W2KKTAVCNFSM6AAAAACIXJPXKKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGOBWHAZTIMJXGA>
> .
> You are receiving this because you authored the thread.Message ID:
> ***@***.***>
>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @mihaiblaga89 on GitHub (Oct 9, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1644
Describe the Bug
I've configured Pangolin with
example.comdomain and I've added a resource mapped to a.b.example.com. Pangolin is set topangolin.example.com. However, the cookie(p_session_token) set by the auth endpoint is set to domain.pangolin.example.comwhich will not be sent fora.b.example.comand this creates a redirect loop. Pangolin is set to use OIDC provider, in my case Google.I've dug around the code a bit to check if I can override the domain with maybe an env variable or the config but can't find anything.
Environment
To Reproduce
Create the above mentioned config.
Expected Behavior
I'd expect to be at least able to override the cookie domain, if setting the cookie on FQDN out of the box cannot be done
@miloschwartz commented on GitHub (Oct 9, 2025):
I think the bug you're experiencing is the same as #1540. I recently pushed a commit to fix this, but it hasn't been released yet. It doesn't have to do with the cookie, but some other logic related to the auto redirect (you can check my commit). Badger in Traefik is responsible for setting the session cookie for the resource domain.
If you confirm the issue is the same as #1540 I will close this as duplicate.
@mihaiblaga89 commented on GitHub (Oct 9, 2025):
Seems similar to what I encounter, and I also have "auto provision", so
let's close this and I'll wait for the release, and if it doesn't fix my
issue i will reopen it. Thanks!
On Thu, Oct 9, 2025 at 20:19 Milo Schwartz @.***> wrote: