[maartenba]

No description provided.

[Copilot]

🟡 Changes recommended

The origin-only path guidance needs correction because it can lead to cookie configurations that throw under non-root hosting paths.

1 open issue

• Clarify cookie path behavior when hosting base path is non-empty · New

What changed in this PR

This PR documents how IdentityServer Spaces scopes cookies and how path-based hosting affects cookie-prefix compatibility.

Changes:

• Explains space-path cookie scoping and which cookies are affected.
• Documents the __Host- restriction and recommends __Secure- for non-root paths.
• Clarifies middleware ordering requirements and updates the page date.

File	Description
astro/​src/​content/​docs/​identityserver/​spaces/​index.mdx	Adds cookie-scoping guidance, prefix restrictions, and middleware-ordering requirements.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The rollout guidance incorrectly implies that cookie path scoping forces reauthentication, even though existing Path=/ cookies continue to be sent to every space path.

1 open issue

• Path scoping does not invalidate existing root-path cookies · New

1 resolved since last review

• Clarify cookie path behavior when hosting base path is non-empty

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because the cookie-path exception appears inconsistent with the documented behavior for origin-only spaces hosted under a nonempty PathBase.

No open issues 🎉

1 resolved since last review

• Path scoping does not invalidate existing root-path cookies

_{Review effort: Balanced}

[maartenba]

Re the __Host- / PathBase inconsistency: confirmed against IdentityServerCookieBuilder at tag is-8.1.0-preview.6. ValidateHostPrefixCompatibility throws whenever the resolved cookie path is not exactly /, so a non-empty PathBase triggers it too, including for origin-only spaces and apps without Spaces. Fixed in 9e81531:

• The caution title now says "with a non-root cookie path" instead of "with path-based spaces".
• It explicitly lists origin-only spaces and apps without Spaces under a non-empty PathBase.
• The quoted exception text is now introduced as "The message starts with", because the real message continues with remediation text.

[Copilot]

🟢 Approval recommended

There are no active review issues for the documentation changes covering space-scoped cookies and deployment considerations.

No open issues 🎉

_{Review effort: Balanced}