Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CSRF and SessionID cookies doesn't have subpath (always using /) when running Label Studio with a subpath #5094

Open
talayalonwsc opened this issue Nov 27, 2023 · 2 comments · May be fixed by #6441
Labels
community:bug Triaged by the community team + confirmed to be bug. community:feature-request Feature Request from the community reviewed by the community team. community:reviewed Issue has been reviewed by the Label Studio Community Team.

Comments

@talayalonwsc
Copy link

talayalonwsc commented Nov 27, 2023

Describe the bug
I'm running multiple Label Studio Deployment on K8s/Kubernetes using your Helm Chart. I'm using a single DNS to route to each Ingress. The Ingress is routing the traffic to each Label Studio based on path.
For Example: I'll create 2 Label Studio Deployment using Helm.

Label Studio A Values:

...
...
global:
  extraEnvironmentVars:
    LABEL_STUDIO_HOST: https://labelstudio.xxxx.xxxx/A
...
...
app:
    contextPath: /A
    Ingress:
       path: /A
       hostname: labelstudio.xxxxx.xxx
...

Label Studio B Values:

...
...
global:
  extraEnvironmentVars:
    LABEL_STUDIO_HOST: https://labelstudio.xxxx.xxxx/B
...
...
app:
    contextPath: /B
    Ingress:
       path: /B
       hostname: labelstudio.xxxxx.xxx
...

When I'm trying to connect to both of them simultaneously, they both get disconnected. My suspect is problems with the sessionid and csrftoken cookies.

Example:
I'm connecting to https://label-studio.xxxx.xx/A but the cookies are shown with /:
image
When I'm opening the UI of Label Studio B (not logging in to it), it shows the cookies (because it's same browser).
When I'm logging in to Label Studio B, both cookies are being updated. And because of that, Label Studio A isn't logged in anymore (because it thinks it's a new session).

To Reproduce

  1. Create 2 label studio deployment on k8s that uses the same DNS and hosted on different paths
  2. Try to connect to both of them simultaneously.

Expected behavior
The Label Studio should stayed connect in both deployment

Environment (please complete the following information):

  • OS: K8s
  • Label Studio Version: Docker Image 1.9.0

Additional context
I saw that Label Studio is using Django to host the UI, there is 2 parameters in Django that can be added in order to support multiple label studio running of different path:

  1. SESSION_COOKIE_PATH: The default is /. (here)
  2. CSRF_COOKIE_PATH: The default is /. (here]
@talayalonwsc talayalonwsc changed the title CSRF cookie and SessionID doesn't have subpath when running Label Studio with a subpath CSRF cookie and SessionID cookies doesn't have subpath (always using /) when running Label Studio with a subpath Nov 27, 2023
@talayalonwsc talayalonwsc changed the title CSRF cookie and SessionID cookies doesn't have subpath (always using /) when running Label Studio with a subpath CSRF and SessionID cookies doesn't have subpath (always using /) when running Label Studio with a subpath Nov 27, 2023
@hogepodge hogepodge added community:bug Triaged by the community team + confirmed to be bug. community:reviewed Issue has been reviewed by the Label Studio Community Team. community:feature-request Feature Request from the community reviewed by the community team. labels Nov 29, 2023
@talayalonwsc
Copy link
Author

@hogepodge
Hi, I saw that your reviewed my issue, thanks.
When or will you be able to address this issue?
Thanks

@hogepodge
Copy link
Contributor

It's currently in the process of being reviewed and assigned to an internal team. I unfortunately don't have any additional information, but it's been categorized as a bug that needs to be addressed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
community:bug Triaged by the community team + confirmed to be bug. community:feature-request Feature Request from the community reviewed by the community team. community:reviewed Issue has been reviewed by the Label Studio Community Team.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants