Fix shared login sessions between staging and production

Description

Currently, staging and production share the same login session scope due to how the session cookie domain is configured.

In config/initializers/session_store.rb, we are stripping subdomains (including staging., stg. and app.) from SITE_URL:

domain = if Rails.env.staging? || Rails.env.production?
           ".#{ENV['SITE_URL'].gsub(/^(www\.)|^(app\.)|^(staging\.)|^(stg\.)/, '')}"
         else
           :all
         end

Openfoodnetwork::Application.config.session_store(
  :active_record_store,
  key: "_ofn_session_id",
  domain: domain
)

Because staging. is stripped, both environments resolve to the same root domain (e.g. .openfoodnetwork.org), which causes:

• Logging into staging to invalidate the production session
• Logging into production to invalidate the staging session

This appears to be an unintended side effect of a previous change meant to fix staging session behavior.

This issue aims to isolate sessions between environments while keeping login functionality intact.

---

Expected Behavior

• Logging into staging should not log the user out of production.
• Logging into production should not log the user out of staging.
• Each environment should maintain its own session cookie.

---

Actual Behaviour

• Staging and production share the same cookie scope.
• Logging into one environment replaces the session in the other.

---

Steps to Reproduce

You can simulate this locally using two subdomains:

1. Update your /etc/hosts file:

127.0.0.1 localhost
127.0.0.1 staging.localhost

2. Start the app server.

3. Open two browser tabs:

• http://localhost:3000
• http://staging.localhost:3000

4. Log into one tab.

5. Log into the other tab.

You will observe that logging into one invalidates the other session because they share the same cookie domain.

You can confirm this by inspecting:

DevTools → Application → Cookies → _ofn_session_id

---

Workaround

Use separate browsers or incognito mode for staging vs production.

---

Severity

bug-s3

A feature (session isolation) is broken but there is a workaround.

---

Your Environment

• Version used: current master
• Browser name and version: Chrome (latest)
• Operating System and version (desktop): macOS / Linux

---

Possible Fix

We should stop stripping staging., stg., app. and www. from SITE_URL.

Required Code Change

Update this line:

".#{ENV['SITE_URL'].gsub(/^(www\.)|^(app\.)|^(staging\.)|^(stg\.)/, '')}"

To:

ENV['SITE_URL']

Why This Works

• Ensures staging and production generate different cookie domains
• We don't use www. and app. subdomains as well
• We just want the session cookie to be used only by the given domain for the environment and not for its subdomains. Hence we should not prepend . with the domain
• Can be fully verified locally