From 0b8cb075a7b7e5d3fe264e558e604a3858478a39 Mon Sep 17 00:00:00 2001 From: Barb Cutler Date: Wed, 7 Oct 2026 00:35:06 -0400 Subject: [PATCH] limit websocket cookies --- Gemfile.lock | 2 -- .../installation/version_notes/v26.10.01.md | 29 +++++++++++++++++++ navtreedata.js | 1 + 3 files changed, 30 insertions(+), 2 deletions(-) create mode 100644 _docs/sysadmin/installation/version_notes/v26.10.01.md diff --git a/Gemfile.lock b/Gemfile.lock index ed196b11..ddfddb3b 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -284,7 +284,6 @@ GEM concurrent-ruby (~> 1.0) unicode-display_width (1.8.0) uri (0.13.0) - wdm (0.2.0) webrick (1.9.2) yell (2.2.2) @@ -301,7 +300,6 @@ DEPENDENCIES github-pages (= 232) html-proofer (~> 3.19.4) json - wdm (>= 0.1.1) webrick (~> 1.9) BUNDLED WITH diff --git a/_docs/sysadmin/installation/version_notes/v26.10.01.md b/_docs/sysadmin/installation/version_notes/v26.10.01.md new file mode 100644 index 00000000..3e5ce65e --- /dev/null +++ b/_docs/sysadmin/installation/version_notes/v26.10.01.md @@ -0,0 +1,29 @@ +--- +title: v26.10.01 > Limit size of websocket cookies +category: System Administrator > Installation Version Notes +--- + +Release [v26.10.01](https://github.com/Submitty/Submitty/releases/v26.10.01) +adds a configuration setting to limit the cookies that are passed to the NGINX server. + +Follow these steps to reconfigure the socket server. + + +1. Edit your NGINX configuration `/etc/nginx/sites-available/submitty.conf` and add the + `proxy_set_header` configuration line below inside of the `location /ws` block, + similar to the sample file: + [https://github.com/Submitty/Submitty/blob/main/.setup/nginx/submitty.conf](https://github.com/Submitty/Submitty/blob/main/.setup/nginx/submitty.conf) + + ``` + # Forward only the cookie the socket server reads. Its HTTP parser (Ratchet) + # closes handshakes over 4096 bytes with a 413, and cookies that other sites + # set on the same domain can push the handshake past that. + proxy_set_header Cookie "submitty_websocket_token=$cookie_submitty_websocket_token"; + ``` + +2. Run regular install script. + + ``` + sudo /usr/local/submitty/.setup/INSTALL_SUBMITTY.sh + ``` + diff --git a/navtreedata.js b/navtreedata.js index b9ca7bc7..e106e618 100644 --- a/navtreedata.js +++ b/navtreedata.js @@ -158,6 +158,7 @@ var NAVTREE = [ "Ansible Server Installation", "/sysadmin/installation/ansible", null ], [ "Version Notes", "/sysadmin/installation/version_notes/index", [ [ "Overview", "/sysadmin/installation/version_notes/index", null], + [ "v26.10.01", "/sysadmin/installation/version_notes/v26.10.01", null ], [ "v26.02.01", "/sysadmin/installation/version_notes/v26.02.01", null ], [ "v25.07.01", "/sysadmin/installation/version_notes/v25.07.01", null ], [ "v23.12.02", "/sysadmin/installation/version_notes/v23.12.02", null ],