Repository navigation
fix: popouts and reconnects on Safari over http://localhost failed with "Session id mismatch" - #1250
Closed
mariobuikhuizen wants to merge 1 commit into
Closed
mariobuikhuizen wants to merge 1 commit into
mariobuikhuizen wants to merge 1 commit into
Conversation
maartenbreddels
temporarily deployed
to
fix/safari-localhost-session-cookie - solara-stable PR #1250
October 8, 2026 12:14 — with 
Render
Destroyed
Render
Destroyed
mariobuikhuizen
force-pushed
the
fix/safari-localhost-session-cookie
branch
from
October 8, 2026 12:14
42b8797 to
2f063bb
Compare
…th "Session id mismatch" Chrome and Firefox accept a Secure cookie from http://localhost, Safari does not (https://bugs.webkit.org/show_bug.cgi?id=218980). Since the server set the session cookie with Secure + SameSite=None on localhost, Safari never sent it back. The first page load worked, because a websocket without a cookie falls back to a fresh session id, but a reconnect or an ipypopout popout then reached the same kernel with a different session id and was refused with "Session id mismatch", leaving a spinner. This is what jdaviz users hit when running jdaviz from the terminal. Over plain http the session cookie is now SameSite=Lax without Secure, on localhost too. That cookie is still sent to an iframe when the embedding page is on localhost as well. Over https, directly or via x-forwarded-proto, it stays Secure + SameSite=None so cross-site iframes keep working. A session mismatch that involves a cookieless session is now logged as a warning that explains the missing cookie, instead of as a possible hack attempt. Supersedes #234. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
mariobuikhuizen
force-pushed
the
fix/safari-localhost-session-cookie
branch
from
October 8, 2026 12:35
2f063bb to
ad76d46
Compare
maartenbreddels
temporarily deployed
to
fix/safari-localhost-session-cookie - solara-stable PR #1250
October 8, 2026 12:35 — with
Render
Destroyed
Render
Destroyed
maartenbreddels
added a commit
that referenced
this pull request
Oct 14, 2026
… cross-site iframes (#1254) * fix: keep Safari sessions stable on http://localhost without breaking cross-site iframes Safari refuses a Secure cookie from http://localhost (https://bugs.webkit.org/show_bug.cgi?id=218980). Solara sets its session cookie with Secure and SameSite=None on localhost, so cross-site iframes work in Chrome and Firefox. Safari therefore never sent the cookie back. Each websocket got a fresh session id, so popouts (ipypopout) and reconnects failed with "Session id mismatch". The jdaviz team reported this. #1250 dropped Secure on localhost. That fixes Safari, but it breaks cross-site iframes on localhost in Chrome and Firefox, the case #102 added. The server now also sets a second cookie, solara-session-id-lax, with SameSite=Lax and no Secure, on plain http on localhost only. Safari keeps it, Chrome and Firefox keep the original one. Every read of the session cookie takes the original first, then the Lax copy, so the page load and the websocket always agree. Over https nothing changes. test_session_cookies checks both cookies on flask and starlette. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test: check the server keeps the session id from the Lax cookie Safari only sends solara-session-id-lax back. Without this check, a broken fallback read would still pass test_session_cookies, which only looked at Set-Cookie. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Contributor
|
replaced by #1254 |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reported by the jdaviz team: running
jdavizfrom the terminal (solara server onhttp://localhost:<port>) and popping out a viewer gives a spinner, and the console showsValueError: Session id mismatch.Cause: Chrome and Firefox accept a
Securecookie fromhttp://localhost, Safari does not (WebKit bug 218980, still open). The server set the session cookie withSecure+SameSite=Noneon localhost, so Safari never sent it back. The first page load still worked, because a websocket without a cookie falls back to a fresh session id (#379), but a reconnect or an ipypopout popout then reaches the same kernel with a different session id and is refused.Changes:
SameSite=LaxwithoutSecure, on localhost too (starlette and flask). That cookie is still sent to an iframe when the embedding page is on localhost as well (same site, the port does not matter). Over https, directly or viax-forwarded-proto, it staysSecure+SameSite=Noneso cross-site iframes keep working.Supersedes #234.
Tests
test_session_cookie_attributes(integration, flask + starlette): plain http givesSameSite=LaxwithoutSecure;x-forwarded-proto: httpsgivesSecure+SameSite=None.test_session_mismatch_without_cookie_is_not_logged_as_hack_attempt(unit).popout_test.pystill passes on Chromium. Playwright WebKit cannot run on this machine (missing system libraries), so the Safari behaviour itself was not exercised in a browser here.🤖 Generated with Claude Code