User session not preserved in eXist-db when the server is accessed via domain name (not IP)
<p>I am trying to configure my eXist-db app for real production environment. This means usage of domain names instead of <code>localhost</code> or IP address. When I access the server via pure IP, everything works. When I access it via domain name, I can log on per page only. I log in, as soon as I try to visit another link (or the current one! again) on the app’s page, I am logged out.</p>

<p>My controller:</p>

<pre><code>xquery version "3.0";

import module namespace login="http://exist-db.org/xquery/login" at "resource:org/exist/xquery/modules/persistentlogin/login.xql";

declare variable $exist:path external;
declare variable $exist:resource external;
declare variable $exist:controller external;
declare variable $exist:prefix external;
declare variable $exist:root external;

declare variable $local:login_domain := 'domain-x';
let $set-user := login:set-user($local:login_domain, (), false())

(: Here we are grabbing all names of user's groups. :)
let $user := request:get-attribute('domain-x.user')
let $groups := if ($user) then string-join(sm:get-user-groups($user), ', ') else 'NoGroup'

return
    if ($exist:path eq '/'or $exist:resource eq 'index.html') then
        &lt;dispatch xmlns='http://exist.sourceforge.net/NS/exist'&gt;
            &lt;forward url='{$exist:controller}/index.html'/&gt;
            &lt;view&gt;
                &lt;forward url="{$exist:controller}/modules/view.xql"/&gt;
            &lt;/view&gt;
            &lt;error-handler&gt;
                &lt;forward url="{$exist:controller}/error-page.html" method="get"/&gt;
                &lt;forward url="{$exist:controller}/modules/view.xql"/&gt;
            &lt;/error-handler&gt;
        &lt;/dispatch&gt;
    else if (
                ($exist:path eq '/create-ebooks-search.html') or
                ($exist:path eq '/create-ebooks-list.html') or
                ($exist:path eq '/metadata-tool.html') or
                ($exist:path eq '/testing.html') or
                ($exist:path eq '/create-ejournals-list.html')
            )
        then
        if (contains($groups, 'editors')) then
            &lt;dispatch xmlns="http://exist.sourceforge.net/NS/exist"&gt;
                &lt;!-- All sites are placed in the 'secure' directory,
                    links to them are as if they were in the root of the app,
                    hence the forwarding. --&gt;
                &lt;forward url='{$exist:controller}/secure/{$exist:resource}'/&gt;
                &lt;view&gt;
                    &lt;forward url="{$exist:controller}/modules/view.xql"&gt;
                        &lt;set-attribute name="hasAccess" value="true"/&gt;&lt;!-- Only for reference --&gt;
                        &lt;set-attribute name="$exist:prefix" value="{$exist:prefix}/secure"/&gt;
                        &lt;set-attribute name="$exist:controller" value="{$exist:controller}"/&gt;
                        &lt;!-- This is very important, without this or similar header, authentication
                             does not work properly—login and logout does not work as expected,
                             on some sites is is detected by the template, on some it is not.
                             It is possible to use other headers, works as well:
                             private, no-store, max-age=0, no-cache, must-revalidate are useful.
                             It is necessary to use it for the forward action of the view. --&gt;
                        &lt;set-header name="Cache-Control" value="no-cache"/&gt;
                    &lt;/forward&gt;
                &lt;/view&gt;
                &lt;error-handler&gt;
                    &lt;forward url="{$exist:controller}/error-page.html" method="get"/&gt;
                    &lt;forward url="{$exist:controller}/modules/view.xql"/&gt;
                &lt;/error-handler&gt;
            &lt;/dispatch&gt;
...
</code></pre>

<p><strong>UPDATE</strong></p>

<p>It seems it could be associated with cookies. If I try to log in on the page accessed via the IP address, there is a cookie called <code>org.exist.login</code> stored and passed across pages on the site. If I try to log in on the page accessed via the domain name, the cookie is missing.</p>

<p><strong>UPDATE II</strong></p>

<p>I am proxying via <a href="https://github.com/OptimalBits/redbird" rel="nofollow noreferrer">Redbird</a>, my config:</p>

<pre><code>var proxy = require('redbird')({
  port:80,
  ssl: {
    port: 443
  }
});
proxy.register('my-app.domain.com', 'http://xx.xx.xxx.xxx:8081/exist/apps/my-app', {
    ssl: {
      key: '../SSL-certs/dev-key.pem',
      cert: '../SSL-certs/dev-cert.pem',
      }
});
</code></pre>

<p>(I was not able to use letsencrypt, described in <a href="https://stackoverflow.com/questions/40487875/how-to-configure-a-secure-https-domain-with-redbird-reverse-proxy">this question</a>.)</p>