# Kibana/Shield sid Cookie Collision

**URL:** <https://discuss.elastic.co/t/kibana-shield-sid-cookie-collision/48068>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [April 21, 2016, 3:16pm UTC](https://discuss.elastic.co/t/kibana-shield-sid-cookie-collision/48068 "2016-04-21T15:16:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jakauppila](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakauppila/32/44935_2.png) [@Jakauppila](https://discuss.elastic.co/u/Jakauppila)\
**Post date:** [April 21, 2016, 3:16pm UTC](https://discuss.elastic.co/t/kibana-shield-sid-cookie-collision/48068/1 "2016-04-21T15:16:12Z")

</div>

Pulling this into a new topic from [Server.basePath redirect loop with Shield](https://discuss.elastic.co/t/server-basepath-redirect-loop-with-shield/46594/7)

I'm routing to multiple Kibana instances from a single URL based on the context utilizing an F5 LTM as a reverse proxy. All Kibana instances are configured to use Shield against the backend ES cluster.

![](https://us1.discourse-cdn.com/elastic/original/2X/0/0e0517bd215fdabb02e64cbaf576cd3cd933b13e.png)

I can login fine to [kibana.contoso.com/foo/](http://kibana.contoso.com/foo/) and get the sid cookie on the path of /foo/

![](https://sea2.discourse-cdn.com/elastic/uploads/default/optimized/2X/c/c44c91974b8893648b37c079ecd781d69403e136_1_690x45.png)

I can then immediately login to [kibana.contoso.com/](http://kibana.contoso.com/) and get it's own sid cookie on path of /

![](https://sea2.discourse-cdn.com/elastic/uploads/default/optimized/2X/d/d30bebe2633eebe451b82857c2b2d6d0ccccf4b5_1_690x38.png)

But if I login to [kibana.contoso.com/](http://kibana.contoso.com/) first and get the cookie, and then proceed to login to [kibana.contoso.com/foo/](http://kibana.contoso.com/foo/) I get stuck in a redirect loop. Since I now see the cookie at path /, I'm guessing that's causing some type of conflict? Simply deleting the sid cookie from / allows me to login fine.

![](https://sea2.discourse-cdn.com/elastic/uploads/default/optimized/2X/b/b864103a25000de1c04534d9e7e0283fdd120b21_1_690x58.png)

Ideally for my use-case, I'd like the option to login to one of the Kibana instances and utilize the same cookie across all of the instances since we're just separating to provide different teams modify access to their own, everyone will have read access to all of them.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:45pm UTC](https://discuss.elastic.co/t/kibana-shield-sid-cookie-collision/48068/2 "2017-07-06T13:45:13Z")

</div>