(fix): preserve session cookie across installer redirect

This commit is contained in:
Jake Barnby
2026-03-18 17:50:47 +13:00
parent 6c383b41f5
commit 114016bbca
2 changed files with 16 additions and 2 deletions
@@ -27,6 +27,7 @@
let activeInstall = null;
let unloadGuard = null;
let sseSessionDetails = null;
const csrfToken = document.querySelector('meta[name="appwrite-installer-csrf"]')?.getAttribute('content') || '';
const withCsrfHeader = (headers = {}) => {
@@ -524,6 +525,9 @@
inProgress: payload.message || payload.step,
done: payload.message || payload.step
};
if (step.id === STEP_IDS.ACCOUNT_SETUP && payload.details?.sessionSecret) {
sseSessionDetails = payload.details;
}
progressState.set(step.id, {
status: payload.status || STATUS.IN_PROGRESS,
message: payload.message,
@@ -599,7 +603,7 @@
});
if (!allDone) return;
const accountState = progressState.get(STEP_IDS.ACCOUNT_SETUP);
const sessionDetails = accountState?.details;
const sessionDetails = sseSessionDetails || accountState?.details;
finalizeInstall();
notifyInstallComplete(activeInstall?.installId, sessionDetails).finally(() => {
setTimeout(() => redirectToApp(), TIMINGS?.redirectDelay ?? 0);
@@ -740,7 +744,7 @@
}
const accountState = progressState.get(STEP_IDS.ACCOUNT_SETUP);
const sessionDetails = accountState?.details;
const sessionDetails = sseSessionDetails || accountState?.details;
finalizeInstall();
notifyInstallComplete(activeInstall?.installId, sessionDetails).finally(() => {
setTimeout(() => redirectToApp(), TIMINGS?.redirectDelay ?? 0);
@@ -48,6 +48,16 @@ class Complete extends Action
@touch(Server::INSTALLER_COMPLETE_FILE);
if (!$sessionSecret && $installId !== '') {
$data = $state->readProgressFile($installId);
$details = $data['details'][Server::STEP_ACCOUNT_SETUP] ?? [];
if (!empty($details['sessionSecret'])) {
$sessionSecret = $details['sessionSecret'];
$sessionId = $sessionId ?: ($details['sessionId'] ?? '');
$sessionExpire = $sessionExpire ?: ($details['sessionExpire'] ?? '');
}
}
if ($sessionSecret) {
$isHttps = $request->getProtocol() === 'https';
$sameSite = $isHttps ? Response::COOKIE_SAMESITE_NONE : Response::COOKIE_SAMESITE_LAX;