Scope the site preview cookie to the preview route so customization/theme persists on navigation (RND-12191) - #4481
Open
zenoachtig wants to merge 5 commits into
Open
Scope the site preview cookie to the preview route so customization/theme persists on navigation (RND-12191)#4481zenoachtig wants to merge 5 commits into
zenoachtig wants to merge 5 commits into
Conversation
… preview (RND-12191) The site preview runs in a cross-site iframe. The preview cookie that carries the unsaved customization (and theme) override was set with SameSite=Lax, so the browser withheld it on in-iframe navigations: the first page reflected the override (it comes from the ?customization= query param) but clicking to another page sent no param and no cookie, so the middleware fell back to the saved settings and the change disappeared. Send the preview cookie with SameSite=None + Secure in production, mirroring the visitor cookies that already have to survive this same iframe (getResponseCookiesForVisitorAuth). Dev stays same-origin so no attributes are needed there. SameSite=None requires Secure, so both are gated on production. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DwxstGi1QSoV6NQBdVDBye
🦋 Changeset detectedLatest commit: 3fdd9de The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
|
The latest updates on your projects. Learn more about Argos notifications ↗︎
|
zenoachtig
marked this pull request as ready for review
August 18, 2026 11:36
Contributor
Style invalidation on a large API referenceElements restyled by opening one popup on the Snyk API reference. A share near or above 100% means the insertion restyles the whole document.
|
taranvohra
approved these changes
Aug 18, 2026
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c7a3c4fd4f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…D-12191) Re-diagnosis after review: app.gitbook.com and sites.gitbook.com are both under the gitbook.com registrable domain, so the preview iframe is cross-origin but same-site — a SameSite=Lax host-only cookie was already eligible on in-iframe navigation, and the earlier SameSite=None change did not address the reported loss in the default flow. Reverted that. The real cause is the cookie path. In production the preview is served under `sites.gitbook.com/preview/<siteId>/...` (url-host mode), but the cookie was scoped to `siteURLData.siteBasePath`, the site's canonical base path (e.g. `/docs`), which does not prefix the preview route. The browser therefore withheld the cookie on the next in-preview navigation, so the override — seeded on the first page via the `?customization=` query param — was lost. Scope the cookie to the preview route prefix `<previewBasePath>/<siteId>`, derived from the request URL, mirroring getVisitorAuthBasePath for proxy requests. Falls back to siteBasePath for any preview not served under the standard preview route. Added preview.test.ts cases covering url-host, url, and the non-preview fallback. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DwxstGi1QSoV6NQBdVDBye
zenoachtig
changed the title
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DwxstGi1QSoV6NQBdVDBye
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
Fixes RND-12191: unsaved customization settings (and previewed theme) are lost as soon as you navigate to another page inside the site customization preview.
Root cause — cookie
pathscoping. The override is seeded onto the first request via a?customization=query param; the middleware applies it and persists it as a preview cookie so that param-less in-iframe navigations keep it (packages/gitbook/src/middleware.ts:420-448). In production the preview is served undersites.gitbook.com/preview/<siteId>/…(mode: 'url-host'), butgetPreviewCookieResponsescoped the cookie tositeURLData.siteBasePath— the site's canonical base path (e.g./docs), which does not prefix the preview route. So:/preview/<siteId>/…with no param; the browser withholds the cookie because itspath(/docs) doesn't match → the middleware falls back to the saved settings → the override disappears. Exactly the reported symptom (theme too).Fix. Scope the preview cookie to the preview route prefix
<previewBasePath>/<siteId>(e.g./preview/<siteId>), derived from the request URL, so it is resent on every in-preview navigation regardless of the site's canonical base path. This mirrorsgetVisitorAuthBasePath(lib/data/visitor.ts), which already derives the path from the request identifier for proxy requests for the same reason. Falls back tositeBasePathfor any preview not served under the standard preview route.SameSitestaysLax(correct for the same-site default). Dev (mode: 'url') was already correct and is unchanged.Tests. Added
preview.test.tscases forgetPreviewCookieResponse: url-host preview scopes to/preview/<siteId>(notsiteBasePath), url mode scopes to/url/<host>/preview/<siteId>, and the non-preview url-host request falls back tositeBasePath. Verified the url-host case fails against the old behaviour and passes with the fix.Still worth a browser check before merge: open customization in GBO, change a color, click to another preview page, and confirm the cookie (
path=/preview/<siteId>) is resent and the override persists.Changelog