apache / apache/shenyu

[Question] 通过神雨网关会强制删除cookie

Open
#6,314 6 comments 0 reactions 0 assignees View on GitHub
type: question
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

### Question

最近改造了一个公司之前的项目有一个问题
就是接入cas单点登录以后通过神雨网关会强制删除cookie

在浏览器响应里会有如下
SESSION=; Path=/; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; HttpOnly; SameSite=Lax
相当于session失效了

但是跳过网关直接请求服务就没有这个设置 不知道在哪里设置的

shenyu版本
2.5.0
shenyu

Image

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the CAS login flow through ShenYu 2.5.0 and compare the Set-Cookie response with a direct service request. Then inspect the gateway route and authentication-related configuration; done means the gateway no longer unexpectedly returns SESSION=... while preserving the intended session behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.