[Question] 通过神雨网关会强制删除cookie
Open
type: question
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
### Question
最近改造了一个公司之前的项目有一个问题
就是接入cas单点登录以后通过神雨网关会强制删除cookie
在浏览器响应里会有如下
SESSION=; Path=/; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; HttpOnly; SameSite=Lax
相当于session失效了
但是跳过网关直接请求服务就没有这个设置 不知道在哪里设置的
shenyu版本
2.5.0
shenyu
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the CAS login flow through ShenYu 2.5.0 and compare the Set-Cookie response with a direct service request. Then inspect the gateway route and authentication-related configuration; done means the gateway no longer unexpectedly returns SESSION=... while preserving the intended session behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100