Skip to content

fix(ui): keep phpMyAdmin's session inside the dashboard iframe so its POSTs stop failing #1462

Description

@geodro

Opening phpMyAdmin in the dashboard overlay renders, but every POST it makes comes back as the error page reading "Cannot connect: invalid settings", so switching servers from its dropdown fails. Reaching the default server keeps working because that is a plain GET, which is why this looks like one engine losing its connection: with only mysql installed the default is mysql, and installing a second engine puts that one behind a POST.

The cause is the session cookie, not the database. phpMyAdmin sets __Secure-phpMyAdmin_https with secure and SameSite=None, because the preset forces $_SERVER['HTTPS'] = 'on' to get SameSite=None accepted at all. The overlay embeds http://localhost:8080 inside the dashboard at http://localhost:7073, so that cookie is third party, and Chromium blocks third party cookies by default in the version Electron ships. The iframe's requests arrive without a session: a GET still renders because phpMyAdmin will start a fresh one, a POST cannot and falls back to a server config it does not have.

Replaying it outside the browser shows the same thing. A server switch POST with a valid session returns a 26k page on the chosen server, the same POST with no cookie returns a 3k page carrying "Cannot connect: invalid settings", and in the container access log every POST the dashboard makes is around 5k while its GETs are full pages, including version-check, whose real response is 64 bytes.

Serving phpMyAdmin through lerd's own nginx under the dashboard origin would make the iframe same origin, which puts the cookie back in first party territory and lets the forced HTTPS and the SameSite=None hack go with it. pgAdmin, Mongo Express and the other embedded admin UIs share the arrangement and want the same treatment.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions