Design for session persistence - Part II #4221
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
the
documentation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4221 +/- ##
==========================================
- Coverage 86.08% 86.07% -0.02%
==========================================
Files 131 131
Lines 14167 14171 +4
Branches 35 35
==========================================
+ Hits 12196 12198 +2
+ Misses 1770 1769 -1
- Partials 201 204 +3 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
salonichf5
commented
Nov 5, 2025
Comment on lines
+149
to
+161
| For **HTTPRoutes**, we do not set the `domain` attribute. Deriving a broader domain (for example, a common suffix across hostnames or a parent domain) would widen the cookie scope to sibling subdomains and increase the risk of cross-host leakage. Since users cannot explicitly configure this field, inferring a shared domain would also be vulnerable to abuse. Leaving domain unset ensures each cookie is scoped to the exact host that issued it. | ||
|
|
||
| To determine the cookie `path` for HTTPRoutes, we handle the simple case where there is a single path match as follows: | ||
|
|
||
| | Path Value | Path Match Type | Cookie `Path` Value | Cookie Match Expectations | | ||
| |-------------------------------------|-----------------|---------------------|---------------------------------------------------------------------------------------------------------------------------------------------------| | ||
| | `/hello-exact` | Exact | `/hello-exact` | Cookie header is sent for `/hello-exact` path only. | | ||
| | `/hello-prefix` | Prefix | `/hello-prefix` | Cookie header is sent for `/hello-prefix` and any subpath starting with `/hello-prefix` (e.g. `/hello-prefix/foo`). | | ||
| | `/hello-regex/[a-zA-Z0-9_-]+$` | Regex | `/hello-regex` | Cookie header is sent for any request whose path starts with `/hello-regex` and matches the regex in the location block (e.g. `/hello-regex/a`, `/hello-regex/abc123`). The regex still determines which requests match the route on the server side. | | ||
|
|
||
| When there are multiple path matches that share the same sessionPersistence configuration, we derive a single cookie path by computing the longest common prefix that ends on a path-segment boundary `/`. If no non-empty common prefix on a segment boundary exists, we fall back to `/` which is allowing all paths. |
Contributor
Author
There was a problem hiding this comment.
I think this is a reasonable first approach for HTTPRoute path handling, but if it’s viewed as over derived then, I’m also comfortable simplifying it to rely on the default cookie path behavior (i.e., not computing a path on the NGF side at all).
sjberman
reviewed
Nov 5, 2025
Collaborator
sjberman
left a comment
sjberman
left a comment
There was a problem hiding this comment.
Be sure to fill out the security/testing/use case sections as provided in the proposal template.
salonichf5
force-pushed
the
docs/session-persistence
branch
from
d9cd13c to
462e832
Compare
sjberman
reviewed
Nov 7, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed changes
Write a clear and concise description that helps reviewers understand the purpose and impact of your changes. Use the
following format:
Problem: Users want sessionPersistence for their server communication
Solution: Add a detailed approach on how to support sessionPersistence for NGF while being community conformant.
Testing: Did a couple of manual checks
Please focus on (optional): If you any specific areas where you would like reviewers to focus their attention or provide
specific feedback, add them here.
Closes #4051
Checklist
Before creating a PR, run through this checklist and mark each as complete.
Release notes
If this PR introduces a change that affects users and needs to be mentioned in the release notes,
please add a brief note that summarizes the change.