HumanSignal / HumanSignal/label-studio
CSRF and SessionID cookies doesn't have subpath (always using /) when running Label Studio with a subpath
- Dominant language
- TypeScript
- Stars
- 28.3k
- Forks
- 3.7k
- Avg merge
- 14h
- Merged PRs (30d)
- 15
Description
**Describe the bug**
I'm running multiple Label Studio Deployment on K8s/Kubernetes using your Helm Chart. I'm using a single DNS to route to each Ingress. The Ingress is routing the traffic to each Label Studio based on path.
For Example: I'll create 2 Label Studio Deployment using Helm.
Label Studio A Values:
```
...
...
global:
extraEnvironmentVars:
LABEL_STUDIO_HOST: https://labelstudio.xxxx.xxxx/A
...
...
app:
contextPath: /A
Ingress:
path: /A
hostname: labelstudio.xxxxx.xxx
...
```
Label Studio B Values:
```
...
...
global:
extraEnvironmentVars:
LABEL_STUDIO_HOST: https://labelstudio.xxxx.xxxx/B
...
...
app:
contextPath: /B
Ingress:
path: /B
hostname: labelstudio.xxxxx.xxx
...
```
When I'm trying to connect to both of them simultaneously, they both get disconnected. My suspect is problems with the `sessionid` and `csrftoken` cookies.
**Example:**
I'm connecting to `https://label-studio.xxxx.xx/A` but the cookies are shown with `/`:

When I'm opening the UI of Label Studio B (not logging in to it), it shows the cookies (because it's same browser).
When I'm logging in to Label Studio B, both cookies are being updated. And because of that, Label Studio A isn't logged in anymore (because it thinks it's a new session).
**To Reproduce**
1. Create 2 label studio deployment on k8s that uses the same DNS and hosted on different paths
2. Try to connect to both of them simultaneously.
**Expected behavior**
The Label Studio should stayed connect in both deployment
**Environment (please complete the following information):**
- OS: K8s
- Label Studio Version: Docker Image 1.9.0
**Additional context**
I saw that Label Studio is using Django to host the UI, there is 2 parameters in Django that can be added in order to support multiple label studio running of different path:
1. `SESSION_COOKIE_PATH`: The default is `/`. ([here](https://docs.djangoproject.com/en/4.2/ref/settings/#session-cookie-path))
2. `CSRF_COOKIE_PATH`: The default is `/`. ([here](https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-CSRF_COOKIE_PATH)]
Contributor guide
Assessment
This issue has not been assessed yet.