diff --git a/codersdk/deployment.go b/codersdk/deployment.go index edbf2ded21..85ce2ea255 100644 --- a/codersdk/deployment.go +++ b/codersdk/deployment.go @@ -2916,9 +2916,9 @@ func (c *DeploymentValues) Options() serpent.OptionSet { Flag: "host-prefix-cookie", Env: "CODER_HOST_PREFIX_COOKIE", Value: serpent.BoolOf(&c.HTTPCookies.EnableHostPrefix), - DefaultFn: func() string { - return strconv.FormatBool(c.AccessURL.Scheme == "https") - }, + // Ideally this is true, however any frontend interactions with the coder api would be broken. + // So for compatibility reasons, this is set to false. + Default: "false", Group: &deploymentGroupNetworking, YAML: "hostPrefixCookie", Annotations: serpent.Annotations{}.Mark(annotationExternalProxies, "true"), diff --git a/docs/reference/cli/server.md b/docs/reference/cli/server.md index b9145202ef..f7a26fceaa 100644 --- a/docs/reference/cli/server.md +++ b/docs/reference/cli/server.md @@ -1065,6 +1065,7 @@ Controls the 'SameSite' property is set on browser session cookies. | Type | bool | | Environment | $CODER_HOST_PREFIX_COOKIE | | YAML | networking.hostPrefixCookie | +| Default | false | Recommended to be enabled. Enables `__Host-` prefix for cookies to guarantee they are only set by the right domain.