Bohan Jiang 0abee49005 docs(self-hosting): require COOKIE_DOMAIN for split-domain deployments (MUL-5413) (#6055) ...

The split-domain reverse-proxy recipe listed FRONTEND_ORIGIN,
CORS_ALLOWED_ORIGINS and NEXT_PUBLIC_API_URL but never COOKIE_DOMAIN.
Without it the session cookies are host-only on the API host, so the
frontend cannot read multica_csrf, never sends X-CSRF-Token, and every
non-GET request is rejected with 403 "CSRF validation failed" while
reads keep working.

Add COOKIE_DOMAIN to the recipe and explain the failure mode, including
the stale-cookie cleanup needed after changing it.

COOKIE_DOMAIN also scopes multica_auth, so the browser sends the session
JWT to every host under that domain — HttpOnly stops page scripts from
reading it, not sibling subdomains from receiving it. Require the
narrowest parent domain covering both hosts, state that every host in
scope must be operated by the same trusted party, and mark the
same-origin layout as recommended since it keeps the cookie host-only.

Also document the requirement and the scope caveat in the environment
variable reference (en/zh/ko/ja).

Refs #6046 (MUL-5413)

2026-07-28 22:11:54 +08:00

..

app

…

components

…

content/docs

docs(self-hosting): require COOKIE_DOMAIN for split-domain deployments (MUL-5413) (#6055)

2026-07-28 22:11:54 +08:00

lib

…

.gitignore

…

middleware.ts

…

next-env.d.ts

…

next.config.mjs

…

package.json

…

postcss.config.mjs

…

source.config.ts

…

tsconfig.json

…

vitest.config.ts

…