Bug: Unable to log in again after logout (`Login.InvalidDomain`)

[Kulturnilpferd]

Environment

• OpenShock API: tag-79-a1

  • Revision: 840534608ae49ab8e4f4d33543d537964dcccb2e

• WebUI: Version 3

• Deployment: Official Docker Compose

• Reverse Proxy: Traefik v2.11.29

• TLS: Let's Encrypt (DNS challenge via Cloudflare)

• DNS:

  • shock.example.tld
  • api.example.tld
  • gateway.example.tld

Steps to reproduce

1. Deploy a fresh OpenShock instance using the official Docker Compose.

2. Configure:

   • OPENSHOCK_WEB_DOMAIN=shock.example.tld
   • OPENSHOCK_API_DOMAIN=api.example.tld
   • OPENSHOCK__FRONTEND__BASEURL=https://shock.example.tld
   • OPENSHOCK__FRONTEND__COOKIEDOMAIN=shock.example.tld

3. Register a new account.

4. Verify the account via email.

5. Login succeeds.

6. Logout.

7. Try logging in again.

Expected behavior

The user should be able to log in again.

Actual behavior

Every subsequent login fails.

The WebUI displays:

Account not activated

However, the API returns:

{
  "type": "Login.InvalidDomain",
  "title": "The url you are requesting a login from is not whitelisted",
  "status": 403,
  "message": "The url you are requesting a login from is not whitelisted"
}

Additional information

• activated_at is correctly set in the users table.
• Password reset works correctly.
• Password reset emails are delivered successfully.
• The password can be changed successfully.
• The account exists and is activated.
• API logs only show:

HTTP POST /1/account/login responded 403

No exception or stack trace is logged.

Additional observations

The WebUI reports:

User Hub
Error: WebSocket failed to connect.
The connection could not be found on the server...

Also, requesting:

https://api.example.tld/hubs/user

returns 404.

Investigation

While debugging, I found that the API returns Login.InvalidDomain from the login endpoint.

This appears to originate from GetCurrentCookieDomain() returning null, even though the frontend and API domains are configured.

Could this be related to the cookie domain matching (DomainUtils.GetBestMatchingCookieDomain) when using separate subdomains such as:

• shock.example.tld
• api.example.tld
• gateway.example.tld

behind Traefik?

[LucHeart]

you need to configure your OPENSHOCK__FRONTEND__COOKIEDOMAIN to be example.tld

[Kulturnilpferd]

Thanks for your quick answer. I understand that setting OPENSHOCK__FRONTEND__COOKIEDOMAIN=example.tld works.

However, I'd like to use shock.example.tld intentionally to scope the authentication cookie to a single subdomain instead of the entire parent domain.

It would be great if OPENSHOCK__FRONTEND__COOKIEDOMAIN also supported fully qualified subdomains such as shock.example.tld. At the moment, this results in Login.InvalidDomain, even though the frontend is accessed from that exact domain.

Is this something that could be supported in the future? Restricting cookies to a specific subdomain is a valid deployment scenario and can be preferable from a security perspective.