Session cookie renamed to fix stale browser cache issues
Posted by tomspark
v1.5.125 ships a fix for the session-loss bug that persisted in 1.5.124 for users with cached cookies from before the original patch. The root cause: Chrome won't let an HTTP origin overwrite a Secure-flagged cookie, so old connect.sid cookies stayed in the browser cache and broke logins. We've renamed the session cookie from connect.sid to sb.sid — a clean slate for everyone, no matter what their browser remembered. This required updates to both the express-session config and the OpenAPI security scheme. We've also added two new headless test scripts (test-seerr-session.js and test-seerr-stale-cookie.js) that simulate real browser behavior—login, idle, multi-tab, search—and specifically reproduce the stale-cookie scenario. Any future Seerr session fix has to pass both before it ships. Check the Updates tab in your dashboard for the full changelog. If you hit any login issues, post here in d/sparkbox. --- Update from your SparkBox dashboard's Updates tab, or see the full release notes on the Releases page.
2 replies
maryo wrote:
I'm getting this error somehow, it was working a while back but now its just not letting me login. looks like the cookie is still named connect.sid for me, not sure why. Also tried to check for updates but nothing. Cookie “connect.sid” has been rejected because there is an existing “secure” cookie. jellyfin XHR GET http://.../api/v1/auth/me [HTTP/1.1 401 Unauthorized 106ms] csrf "..."
Chris wrote:
Apologies this went unanswered for so long — and thank you, because what you spotted was real. More than one app on your box was writing a cookie called connect.sid on the same hostname, and cookies are scoped by host, not by port. So logging into one could overwrite another's session and leave you bounced to a login screen. They have since been given distinct names so they stop clobbering each other. That arrives with a release update, which is why your update check showed nothing — that one only refreshes app images. Over SSH: sudo sparkbox upgrade Then clear this site's cookies in your browser once to drop the stale one. — Chris