starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-25 16:55:59 +03:00

[GH-ISSUE #5378] [feature]: Support alternate session cookie name #2063

New issue

Closed

opened 2026-03-16 23:02:51 +03:00 by kerem · 5 comments

kerem commented

2026-03-16 23:02:51 +03:00

Owner

Originally created by @treyturner-nirvana on GitHub (Sep 5, 2025).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5378

Originally assigned to: @CHANDRAHARSHIT on GitHub.

Is there an existing issue for this?

I have searched the existing issues

Summary

I'm using Kong 3.4.2 and need to configure sticky sessions in order to end up on the same pod during OAuth callback that redirected me to OAuth to begin with (so as to prevent a 401 when I return). Unfortunately, this version of Kong doesn't allow for hashing based on cookie names that include a period like connect.sid:

2025-09-05T16:56:21Z    error   failed updating gateway entity  {"action": "update", "kind": "upstream", "name": "httproute.hoppscotch.hoppscotch-api.0", "error": "HTTP status 400 (message: \"2 schema violations (failed conditional validation given value of field 'hash_on'; hash_on_cookie: bad cookie name 'connect.sid', allowed characters are A-Z, a-z, 0-9, '_', and '-')\")"}

I'll work on getting my org to upgrade Kong; in the interim a convenient handle in support of a workaround would be to allow renaming the cookie as documented here:

const session = require('express-session');
app.use(session({
    name : process.env.SESSION_COOKIE_NAME || 'connect.sid',
    ...
}));

Thanks for your consideration.

Why should this be worked on?

I can't run more than one replica and successfully login with OAuth using Kong 3.4.2 without the ability to rename the session cookie.

Originally created by @treyturner-nirvana on GitHub (Sep 5, 2025). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5378 Originally assigned to: @CHANDRAHARSHIT on GitHub. ### Is there an existing issue for this? - [x] I have searched the existing issues ### Summary I'm using Kong 3.4.2 and need to configure sticky sessions in order to end up on the same pod during OAuth callback that redirected me to OAuth to begin with (so as to prevent a 401 when I return). Unfortunately, this version of Kong doesn't allow for hashing based on cookie names that include a period like `connect.sid`: ``` 2025-09-05T16:56:21Z error failed updating gateway entity {"action": "update", "kind": "upstream", "name": "httproute.hoppscotch.hoppscotch-api.0", "error": "HTTP status 400 (message: \"2 schema violations (failed conditional validation given value of field 'hash_on'; hash_on_cookie: bad cookie name 'connect.sid', allowed characters are A-Z, a-z, 0-9, '_', and '-')\")"} ``` I'll work on getting my org to upgrade Kong; in the interim a convenient handle in support of a workaround would be to allow renaming the cookie as documented [here](https://expressjs.com/en/resources/middleware/session.html): ``` const session = require('express-session'); app.use(session({ name : process.env.SESSION_COOKIE_NAME || 'connect.sid', ... })); ``` Thanks for your consideration. ### Why should this be worked on? I can't run more than one replica and successfully login with OAuth using Kong 3.4.2 without the ability to rename the session cookie.

kerem

2026-03-16 23:02:51 +03:00

closed this issue
added the
feature
label

kerem commented

2026-03-16 23:03:07 +03:00

Author

Owner

@yashgoyal0110 commented on GitHub (Sep 30, 2025):

Hey @treyturner-nirvana
May i work on it?

@yashgoyal0110 commented on GitHub (Sep 30, 2025): Hey @treyturner-nirvana May i work on it?

kerem commented

2026-03-16 23:03:12 +03:00

Author

Owner

@CHANDRAHARSHIT commented on GitHub (Oct 2, 2025):

Adds an optional override for the express-session cookie name so deployments can avoid the default connect.sid (which contains a dot).
This helps Kong 3.4.2 sticky sessions, which can’t hash cookie names with dots (only A–Z, a–z, 0–9, _ and - are allowed).

@CHANDRAHARSHIT commented on GitHub (Oct 2, 2025): Adds an optional override for the express-session cookie name so deployments can avoid the default connect.sid (which contains a dot). This helps Kong 3.4.2 sticky sessions, which can’t hash cookie names with dots (only A–Z, a–z, 0–9, _ and - are allowed).

kerem commented

2026-03-16 23:03:18 +03:00

Author

Owner

@jamesgeorge007 commented on GitHub (Oct 31, 2025):

Hi @treyturner-nirvana, closing this issue since it is now addressed in the latest release. Please feel free to share any feedback.

@jamesgeorge007 commented on GitHub (Oct 31, 2025): Hi @treyturner-nirvana, closing this issue since it is now addressed in the [latest release](https://github.com/hoppscotch/hoppscotch/releases/tag/2025.10.0). Please feel free to share any feedback.

kerem commented

2026-03-16 23:03:23 +03:00

Author

Owner

@jamesgeorge007 commented on GitHub (Oct 31, 2025):

Session cookie name can be configured from the Admin dashboard settings page.

@jamesgeorge007 commented on GitHub (Oct 31, 2025): Session cookie name can be configured from the Admin dashboard settings page. <img width="1415" height="853" alt="Image" src="https://github.com/user-attachments/assets/d674ed7e-92be-4b51-9b83-0772ddfa12c0" />

kerem commented

2026-03-16 23:03:28 +03:00

Author

Owner

@treyturner-nirvana commented on GitHub (Nov 7, 2025):

Thanks for the rapid response on this @CHANDRAHARSHIT, I really appreciate it! This works great for my purposes.

Technically I can't think of a reason to reject periods in the override name. It was a problem for my environment, but it'd be fine in lots of others. I'm sure it could wait for someone to ask about it though 😁 Cheers! 🥂

@treyturner-nirvana commented on GitHub (Nov 7, 2025): Thanks for the rapid response on this @CHANDRAHARSHIT, I really appreciate it! This works great for my purposes. Technically I can't think of a reason to reject periods in the override name. It was a problem for my environment, but it'd be fine in lots of others. I'm sure it could wait for someone to ask about it though 😁 Cheers! 🥂