Skip to content

Add support for alternative domains for Invidious cookies#5647

Open
Fijxu wants to merge 2 commits intoiv-org:masterfrom
Fijxu:alternative-domains
Open

Add support for alternative domains for Invidious cookies#5647
Fijxu wants to merge 2 commits intoiv-org:masterfrom
Fijxu:alternative-domains

Conversation

@Fijxu
Copy link
Member

@Fijxu Fijxu commented Feb 23, 2026

Closes #1421

Adds a new configuration option called alternative_domains, a list of additional domains from where the Invidious instance is hosted, this will make hosting Invidious in other domains like Tor hidden services, I2P tunnels, Yggdrasil or any other type of domain that is inserted.

It needs the usage of a reverse proxy to pass the X-Forwarded-Host header to Invidious, since that is the header that will be used to detect the alternative domains. It could be more flexible and just use Host, in that way, there is no need to use a reverse proxy, but I decided to go with X-Forwarded-Host since it's de-facto standard header for identifying the original host requested by the client in the Host HTTP request header. (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-Host)

Instance administrators will also need to add their additional domains in their reverse proxy configuration, but that will depend on their reverse proxy configuration.

For nginx, that would mean adding the additional domain to their server_name server directive, example:

  server {
    server_name
           invidious-github.localhost
           someotherdomain.lol
           meowdious.i2p
           superhiddenservicetpm6zs3j4f33elo6wkpbjpxela6uv7hzomeyd.onion
	   ;
    listen 80;
    location / {
      proxy_pass http://127.0.0.1:30001;
      proxy_set_header X-Forwarded-Host $host;
    }
  }

Here is a demonstration on how the Set-Cookie header looks like when using an alternative domain:

image

Comment on lines +14 to +20
# Not secure if it's being accessed from I2P
# Browsers expect the domain to include https. On I2P there is no HTTPS
# Tor browser works fine with secure being true
if (domain.try &.split(".").last == "i2p") && @@secure
@@secure = false
end

Copy link
Member Author

@Fijxu Fijxu Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just as a note, when using .i2p domains, secure has to be false, otherwise, the browser using an I2P proxy will reject the cookie. But this seems to be too hardcoded, so I was thinking about modifying alternative_domains to let the instance administrator to define if they want the Cookie to be secure or not secure, because it really depends on where they are hosting Invidious and how the browser of the client is configured. Something like this basically, but I'm not too sure so suggestions are appreciated!:

alternative_domains:
  - something.i2p
    secure: false
  - othersomething.onion
    secure: true
  - alternative-clearnet.lol
    secure: true

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Login broken on instances served on the tor network if they are also served on the clearnet

1 participant