From 931cf2d065fbb3471620d065ffb1dc87ab25cf62 Mon Sep 17 00:00:00 2001 From: wuyang6 Date: Tue, 26 May 2026 16:24:11 +0800 Subject: [PATCH] fix: isolate auth cookies per deploy --- frontend/app/lib/claw-auth.ts | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/frontend/app/lib/claw-auth.ts b/frontend/app/lib/claw-auth.ts index 2ba811f..fed9230 100644 --- a/frontend/app/lib/claw-auth.ts +++ b/frontend/app/lib/claw-auth.ts @@ -10,7 +10,7 @@ const AUTH_STATE_ROOT = path.join( ); const USERS_PATH = path.join(AUTH_STATE_ROOT, "users.json"); const SESSIONS_PATH = path.join(AUTH_STATE_ROOT, "auth_sessions.json"); -const COOKIE_NAME = "claw_account_session"; +const COOKIE_NAME = authCookieName(); const SESSION_MAX_AGE_SECONDS = 60 * 60 * 24 * 30; const SESSION_REFRESH_INTERVAL_MS = 60 * 60 * 12 * 1000; const LINUX_ACCOUNT_WORKSPACE_NAME = "zk-agent"; @@ -303,6 +303,23 @@ function shouldRefreshSession(value?: string) { return Date.now() - timestamp > SESSION_REFRESH_INTERVAL_MS; } +function authCookieName() { + const explicit = sanitizeCookieNamePart(process.env.CLAW_AUTH_COOKIE_NAME); + if (explicit) return explicit; + const instance = + sanitizeCookieNamePart(process.env.CLAW_DEPLOY_INSTANCE) || + sanitizeCookieNamePart(process.env.CLAW_SERVICE_SCOPE) || + "local"; + const port = sanitizeCookieNamePart(process.env.CLAW_FRONTEND_PORT) || "dev"; + return `claw_account_session_${instance}_${port}`; +} + +function sanitizeCookieNamePart(value?: string) { + const normalized = (value ?? "").trim().toLowerCase(); + if (!normalized) return ""; + return normalized.replace(/[^a-z0-9_-]+/g, "_").replace(/^_+|_+$/g, ""); +} + function linuxAccountsEnabled() { return ["1", "true", "yes", "on"].includes( (process.env.CLAW_ENABLE_LINUX_ACCOUNTS ?? "").trim().toLowerCase(),