HumanSignal / HumanSignal/label-studio

CSRF and SessionID cookies doesn't have subpath (always using /) when running Label Studio with a subpath

Open
#5,094 2 comments 0 reactions 0 assignees View on GitHub
community:bug community:feature-request community:reviewed
Dominant language
TypeScript
Stars
28.3k
Forks
3.7k
Avg merge
14h
Merged PRs (30d)
15

Description

**Describe the bug**
I'm running multiple Label Studio Deployment on K8s/Kubernetes using your Helm Chart. I'm using a single DNS to route to each Ingress. The Ingress is routing the traffic to each Label Studio based on path.
For Example: I'll create 2 Label Studio Deployment using Helm.

Label Studio A Values:
```
...
...
global:
extraEnvironmentVars:
LABEL_STUDIO_HOST: https://labelstudio.xxxx.xxxx/A
...
...
app:
contextPath: /A
Ingress:
path: /A
hostname: labelstudio.xxxxx.xxx
...
```

Label Studio B Values:
```
...
...
global:
extraEnvironmentVars:
LABEL_STUDIO_HOST: https://labelstudio.xxxx.xxxx/B
...
...
app:
contextPath: /B
Ingress:
path: /B
hostname: labelstudio.xxxxx.xxx
...
```

When I'm trying to connect to both of them simultaneously, they both get disconnected. My suspect is problems with the `sessionid` and `csrftoken` cookies.

**Example:**
I'm connecting to `https://label-studio.xxxx.xx/A` but the cookies are shown with `/`:
![image](https://github.com/HumanSignal/label-studio/assets/141231397/0b89b20e-0e27-4a52-8a16-af843eeba80e)
When I'm opening the UI of Label Studio B (not logging in to it), it shows the cookies (because it's same browser).
When I'm logging in to Label Studio B, both cookies are being updated. And because of that, Label Studio A isn't logged in anymore (because it thinks it's a new session).

**To Reproduce**
1. Create 2 label studio deployment on k8s that uses the same DNS and hosted on different paths
2. Try to connect to both of them simultaneously.

**Expected behavior**
The Label Studio should stayed connect in both deployment

**Environment (please complete the following information):**
- OS: K8s
- Label Studio Version: Docker Image 1.9.0

**Additional context**
I saw that Label Studio is using Django to host the UI, there is 2 parameters in Django that can be added in order to support multiple label studio running of different path:
1. `SESSION_COOKIE_PATH`: The default is `/`. ([here](https://docs.djangoproject.com/en/4.2/ref/settings/#session-cookie-path))
2. `CSRF_COOKIE_PATH`: The default is `/`. ([here](https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-CSRF_COOKIE_PATH)]

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.