[FEATURE] turnstile and maybe antibot challenge cross subdomain

[accltza]

What happened?

Hello,
When trying to use the antibot with turnstile to protect multiple subdomain i found that the cookie set for the challenge is restricted to host only or when looking at the set cookie there is no host so it default to host only.
I've tried to set the session name with SESSIONS_NAME variable and add COOKIE_FLAGS but cookie flag do touch the domain. (i use MULTISITE and all domain/sub are in SERVER_NAME )

So the effect is that if user pass antibot for on domain it will redo the check for the subdomain.
i didn't found any doc concerning that part.

best regards,

How to reproduce?

use antibot with turnstile on multiple subomain

Configuration file(s) (yaml or .env)

Relevant log output

BunkerWeb version

1.6.9

What integration are you using?

Docker

Linux distribution (if applicable)

No response

Removed private data

• I have removed all private data from the configuration file and the logs

Code of Conduct

• I agree to follow this project's Code of Conduct

[TheophileDiot]

Hi @accltza, thanks for the report

Root cause: The antibot state lives in the BunkerWeb session cookie (lua-resty-session), and sessions.lua never sets cookie_domain — so the cookie is emitted host-only and isn't shared across subdomains. COOKIE_FLAGS can't fix this because set_cookie_flag can only append flags, not inject a Domain= attribute.

Fix (next release): A new multisite SESSIONS_DOMAIN setting (default empty, backwards-compatible) that wires cookie_domain through on a per-server basis, so it stays scoped to the tenant you configure it for.

For your case:

SERVER_NAME: "a.example.com b.example.com c.example.com"
USE_ANTIBOT: "turnstile"
a.example.com_SESSIONS_DOMAIN: "example.com"
b.example.com_SESSIONS_DOMAIN: "example.com"
c.example.com_SESSIONS_DOMAIN: "example.com"

A leading dot (.example.com) is also accepted. The Turnstile challenge will then be solved once for the whole *.example.com set.

This will be included in the next release (1.6.10)