Scope the admin cookie path requirement to the versions it affects - #3468
Open
derrickmehaffy wants to merge 1 commit into
Open
Scope the admin cookie path requirement to the versions it affects#3468derrickmehaffy wants to merge 1 commit into
derrickmehaffy wants to merge 1 commit into
Conversation
The default cookie path changed in 5.51, so the extra configuration step applies from that version onwards. Also corrects the symptom: the browser does send the refresh cookie, the panel just cannot read its own access cookie from a page outside the cookie path, so login appears to succeed and then every request is rejected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
pr: chore
source: CMS
internal
pwizla
added
the
flag: merge pending release
pwizla
approved these changes
Sep 11, 2026
pwizla
left a comment
pwizla
left a comment
Collaborator
There was a problem hiding this comment.
LGTM, but I'll wait for the strapi/strapi PR to be merged before releasing this one
(By the way, new docs feature: when a strapi/strapi release includes the corresponding strapi/strapi PR, the flag: merge pending release label on this docs PR will be removed automatically ✨)
Collaborator
|
(FYI: tentatively added to next week's docs milestone, hoping it will be merged for that date; if not I'll postpone it, no worries) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR scopes the admin cookie path warning to the versions it applies to, since the default cookie path changed in Strapi 5.51. It also corrects the stated symptom: the browser does send the refresh cookie, so requests to the admin API are authenticated at that layer. What fails is the admin panel reading its own access cookie from a page outside the cookie path, so the login request succeeds and every request after it is rejected. Verified by reproducing it on 5.53.0 with
urlset to/dashboard.A fix is proposed in strapi/strapi#27619 to derive the cookie path from
urlautomatically. Once that ships, this snippet should gain an upper version bound or be removed.Direct preview link 👉 here