Skip to main content

Deploy browser apps with user sessions

Configure the Console and Investor portal when they run on separate hosts and keep session cookies on each app origin.

The Console and the Investor portal can use separate public hosts. A browser app with a host-only session cookie serves the Platform API paths on its own origin and forwards them to the private Platform API service, so the cookie reaches the server-rendered pages that check it.

The Investor portal in the chart forwards these paths with the SDK's createDalpProxy, to the address in DAPI_INTERNAL_URL, which the chart sets to http://dalp-api:3001. A browser app you build on the SDK mounts the same createDalpProxy at its /api and /dalp routes, as browser apps with user sessions shows. Set each app's public URL separately: global.dalpApp.config.app.http.url for the Console and global.dalpApp.env.INVESTOR_PORTAL_URL for the Investor portal. Do not set a public DAPI_URL for the browser: the browser calls the app origin, and the server forwards the request internally.

Helm

The chart passes the Investor portal its DAPI_INTERNAL_URL and the trusted edge profile, TRUSTED_PROXY_PROFILE, read from global.dalpApp.config.trustedProxy.profile. The Console applies the same profile. The profile is one of envoy, nginx, openshift or none. Set it to match the ingress or gateway in front of the apps, because the apps read the client address from that proxy's forwarding header, and none discards every forwarding header. Set the portal's public URL once, in global.dalpApp.env.INVESTOR_PORTAL_URL: the chart passes it to the portal container and lists it as a Portal origin in the Platform API.

global:
  dalpApp:
    env:
      INVESTOR_PORTAL_URL: "https://portal.example"
investorPortal:
  enabled: true

investorPortal.env already sets PORT to 3000 and DAPI_INTERNAL_URL to http://dalp-api:3001. An env list you supply replaces the chart's list, so repeat both entries in it when you change one.

Investor portal explains what investors see once the portal runs and how the portal applies your organisation's theme.

INVESTOR_PORTAL_URL replaces CLIENT_PORTAL_URL. When INVESTOR_PORTAL_URL is empty, the portal still reads CLIENT_PORTAL_URL and logs CLIENT_PORTAL_URL is renamed INVESTOR_PORTAL_URL; the next release no longer reads the old name. Rename the value before your next upgrade.

Give the Console and the Investor portal separate routes when they use separate hosts. The forwarding preserves Set-Cookie, event streams and the auth-surface headers, and stamps the app origin when a server-side request has no Origin. Each app forwards GET, HEAD, POST, PUT, PATCH, DELETE and OPTIONS. Any other method on an /api path gets HTTP 405 with the code METHOD_NOT_ALLOWED and an Allow header from the app itself, with the same security headers as every other /api response.

OpenShift

Apply the OpenShift overlay and set the public Route host for each app. The Investor portal uses its in-cluster DAPI_INTERNAL_URL and needs no Platform API Route. Keep DAPI_INTERNAL_URL private and set global.dalpApp.env.INVESTOR_PORTAL_URL to the public Portal host. Deploy DALP to OpenShift lists the Route and network-policy checks.

Sign-in returns to login

A successful sign-in followed by a login page means the cookie was issued by a different host. In the browser's network panel, check that the sign-in request is /api/auth/sign-in/email on the app host, and that the response's Set-Cookie names no public Platform API host. Remove DAPI_URL, check that the app serves /api on its own host, clear the old cookie and sign in again.

Browser apps with user sessions has the handler example and the forwarding rules.

Was this page helpful?