Multi-Domain Access Apps Get a Say in When Their Authorization Cookie Gets Set!

Hey everyone, it's Shii-chan! Today I found a small but genuinely useful update for anyone running Cloudflare Access.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, Access administrators can now choose whether a self-hosted application eagerly sets its authorization cookie across all of its public hostnames. The new setting is called Eager redirect cookie.

The story so far

Until now, this behavior was decided automatically by hostname count. Applications with 5 or fewer hostnames always got eager redirects, meaning the authorization cookie was set for every hostname right after sign-in. Applications with 6 or more hostnames only received the cookie as the user actually visited each hostname. Administrators had no way to override either behavior.

What changes

Now administrators can pick either behavior regardless of how many hostnames an application has. Eager redirect cookie is turned on by default for newly created applications: after sign-in, the browser gets redirected through each hostname in turn and receives a CF_Authorization cookie along the way. That's great for applications that need to make requests across hostnames before a user has actually visited each one.

Dive Deep

On the flip side, that redirect chain can trigger sign-in loops in some browsers when an application has many hostnames. Turning the setting off avoids that by issuing the cookie only when a user visits each hostname individually. The exact configuration steps live in the Authorization cookie documentation.

Wrap-up

• Access administrators can now choose whether self-hosted apps eagerly set authorization cookies across all hostnames
• Previously this was decided automatically: 5 or fewer hostnames got eager redirects, 6 or more got cookies only on visit
• The new Eager redirect cookie setting is on by default for new applications
• Turning it off can prevent sign-in loops on applications with many hostnames

If you manage Access applications spread across multiple domains and want tighter control over sign-in behavior, this one's for you!