# How can I set \_prodigy\_ cookie's domain separate from host bind address?

**URL:** <https://support.prodi.gy/t/how-can-i-set-prodigy-cookies-domain-separate-from-host-bind-address/5536>\
**Category:** Getting Started\
**Tags:** install\
**Created:** [April 15, 2022, 8:45pm UTC](https://support.prodi.gy/t/how-can-i-set-prodigy-cookies-domain-separate-from-host-bind-address/5536 "2022-04-15T20:45:05Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![jb3k](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/jb3k/32/2889_2.png) [@jb3k](https://support.prodi.gy/u/jb3k)\
**Post date:** [April 15, 2022, 8:45pm UTC](https://support.prodi.gy/t/how-can-i-set-prodigy-cookies-domain-separate-from-host-bind-address/5536/1 "2022-04-15T20:45:05Z")

</div>

I am attempting to run prodigy behind a reverse proxy. Unfortunately, the `_prodigy_` cookie's domain is set by the `host`/`PRODIGY_HOST` configuration values.

When visiting a prodigy page, the browser console logs: `Cookie "_prodigy_" has been rejected for invalid domain.`

You can recreate the cookie issue by launching prodigy locally with `PRODIGY_HOST=0.0.0.0` and visiting `http://localhost:8080`.

I want prodigy to listen on `0.0.0.0` but set the cookie's domain to `x.y.z` for example. How can I best accomplish this goal?

---

<div class="post-metadata">

**Author:** ![koaning](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/koaning/32/230_2.png) [@koaning](https://support.prodi.gy/u/koaning)\
**Post date:** [April 19, 2022, 9:49am UTC](https://support.prodi.gy/t/how-can-i-set-prodigy-cookies-domain-separate-from-host-bind-address/5536/2 "2022-04-19T09:49:15Z")

</div>

Hi Jon.

Do you see an error in the console or does the app not load?

You may find this commend insightful in the meantime:

> [@Securing Backend API Call](https://support.prodi.gy/t/securing-backend-api-call/5203):
>
> I have a question about API authentication. I noticed there is a Cookie in the heather of the API call from the web interface to the backend server but I can call the server from the postman with the same API call and no headers. Does anyone know what that header is for and is there any way to secure the API call? I'm planning to deploy prodigy as a web app as most of our team are working from home now. I can add an authentication layer to the web app to secure the login. I also can add the whol…

---

<div class="post-metadata">

**Author:** ![jb3k](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/jb3k/32/2889_2.png) [@jb3k](https://support.prodi.gy/u/jb3k)\
**Post date:** [May 18, 2022, 8:13pm UTC](https://support.prodi.gy/t/how-can-i-set-prodigy-cookies-domain-separate-from-host-bind-address/5536/3 "2022-05-18T20:13:42Z")

</div>

Vincent,

Thanks for the reply and apologies for my tardy follow-up. Unfortunately, I did not get a notification.

The error occurs in the browser console logs. Due to the prodigy server configuration limitation, the cookie is not stored in the browser and re-sent back to the server in a subsequent response.

Maybe the `_prodigy_` cookie is not used by the prodigy server.

---

<div class="post-metadata">

**Author:** ![koaning](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/koaning/32/230_2.png) [@koaning](https://support.prodi.gy/u/koaning)\
**Post date:** [May 19, 2022, 9:06am UTC](https://support.prodi.gy/t/how-can-i-set-prodigy-cookies-domain-separate-from-host-bind-address/5536/4 "2022-05-19T09:06:57Z")

</div>

Let's go over a few checks then.

Could you confirm the Prodigy/Python version just to ensure that you're running a modern version?

Could you confirm that this issue persists across browsers? I'm aware of a few mishaps on the Brave browser.

Is there anything noteworthy when you look at the verbose Prodigy logs? You can view the logs via;

```python
PRODIGY_LOGGING=verbose prodigy ... 

```

---

<div class="post-metadata">

**Author:** ![jb3k](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/jb3k/32/2889_2.png) [@jb3k](https://support.prodi.gy/u/jb3k)\
**Post date:** [June 28, 2022, 7:06pm UTC](https://support.prodi.gy/t/how-can-i-set-prodigy-cookies-domain-separate-from-host-bind-address/5536/5 "2022-06-28T19:06:53Z")

</div>

Vincent,

Again, thanks for the reply and apologies for my tardy follow-up.

"Prodigy/Python version?": v3.10 and v1.11.7

"Could you confirm that this issue persists across browsers?" Yes. I tested with latest Chrome, Firefox and Safari.

"Is there anything noteworthy when you look at the verbose Prodigy logs?" Unfortunately, there is no noteworthy information from the server. The browsers are rejecting the cookie because the cookies' domain (0.0.0.0) does not match localhost.

---

<div class="post-metadata">

**Author:** ![koaning](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/koaning/32/230_2.png) [@koaning](https://support.prodi.gy/u/koaning)\
**Post date:** [June 30, 2022, 7:03am UTC](https://support.prodi.gy/t/how-can-i-set-prodigy-cookies-domain-separate-from-host-bind-address/5536/6 "2022-06-30T07:03:36Z")

</div>

I just tried running this locally on my server:

```python
PRODIGY_HOST=0.0.0.0 python -m prodigy checkbox -F recipe.py

```

I am able to:

- open up `http://localhost:8080` locally
- open up `http://0.0.0.0:8080` locally
- have VSCode ssh into the same machine and forward everything properly on my laptop

This is making me wonder if this is perhaps a firewall setting on your end. So just to check, are you able to run webservers just fine? Can you visit the fileserver via the browser when you run this in a folder with files:

```python
python3 -m http.server

```

---

<div class="post-metadata">

**Author:** ![jb3k](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/jb3k/32/2889_2.png) [@jb3k](https://support.prodi.gy/u/jb3k)\
**Post date:** [July 5, 2022, 7:57pm UTC](https://support.prodi.gy/t/how-can-i-set-prodigy-cookies-domain-separate-from-host-bind-address/5536/7 "2022-07-05T19:57:39Z")

</div>

Vincent,

Thanks for sticking with my question, BTW.

I can browse also. If you check your browser's console log, you will see that the `_prodigy_` cookie is rejected as the cookie's domain, `0.0.0.0`, does not match the URL's host (e.g., localhost).

Either:  
a) The cookie is not required and all is well, or  
b) Due to the cookie being required, we are not able to deploy prodigy behind a proxy (e.g., some.internal.domain) and have prodigy listen a containerized interface (e.g., 0.0.0.0).

---

<div class="post-metadata">

**Author:** ![koaning](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/koaning/32/230_2.png) [@koaning](https://support.prodi.gy/u/koaning)\
**Post date:** [July 6, 2022, 9:47am UTC](https://support.prodi.gy/t/how-can-i-set-prodigy-cookies-domain-separate-from-host-bind-address/5536/8 "2022-07-06T09:47:45Z")

</div>

When I run it, I do not see a cookie rejection notice.

 ![image](https://us1.discourse-cdn.com/flex020/uploads/prodigy/original/2X/7/79560a8053c40e9b077d1425579ee6bdf5aa51b1.png)

Just to check one more thing, are you running any browser extensions that might influence this?

Also, besides this warning in the console, are you noticing any other issues?

---

<div class="post-metadata">

**Author:** ![jb3k](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/jb3k/32/2889_2.png) [@jb3k](https://support.prodi.gy/u/jb3k)\
**Post date:** [July 15, 2022, 6:09pm UTC](https://support.prodi.gy/t/how-can-i-set-prodigy-cookies-domain-separate-from-host-bind-address/5536/9 "2022-07-15T18:09:06Z")

</div>

Vincent,

No browser extensions are loaded. The error is logged in both desktop Firefox and Safari consoles. Your screenshot looks like you are using Chrome. I did not test Chrome.

Other than the console warning, I am not sure what the cookie's purpose is. Prodigy is not always reliable (e.g., duplicate annotations in output). I thought the cookie issue might reduce reliability as it was the only logged error I could find in either server or browser session.

If it helps, my local prodigy setup is a docker image running prodigy that I attempt to access locally using port forwarding.

---

<div class="post-metadata">

**Author:** ![koaning](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/koaning/32/230_2.png) [@koaning](https://support.prodi.gy/u/koaning)\
**Post date:** [July 19, 2022, 1:23pm UTC](https://support.prodi.gy/t/how-can-i-set-prodigy-cookies-domain-separate-from-host-bind-address/5536/10 "2022-07-19T13:23:07Z")

</div>

Could you share the `Dockerfile` that Prodigy is running in? It's much easier to figure out a solution if I can reproduce the error locally.

---

<div class="post-metadata">

**Author:** ![jb3k](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/jb3k/32/2889_2.png) [@jb3k](https://support.prodi.gy/u/jb3k)\
**Post date:** [July 22, 2022, 9:16am UTC](https://support.prodi.gy/t/how-can-i-set-prodigy-cookies-domain-separate-from-host-bind-address/5536/11 "2022-07-22T09:16:52Z")

</div>

Vincent,

Here is the contents of the `Dockerfile`:

```python
FROM python:3.10-slim

COPY prodigy-*-cp310-cp310-linux_x86_64.whl /tmp/
RUN python -m pip install --no-cache prodigy -f /tmp/ && \
    rm /tmp/prodigy-*-cp310-cp310-linux_x86_64.whl && \
    python -m pip install --no-cache psycopg2-binary && \
    groupadd prodigy && \
    useradd -m -g prodigy prodigy
USER prodigy
WORKDIR /home/prodigy

COPY training_data/* /home/prodigy/

```

---

<div class="post-metadata">

**Author:** ![koaning](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/koaning/32/230_2.png) [@koaning](https://support.prodi.gy/u/koaning)\
**Post date:** [July 26, 2022, 3:22pm UTC](https://support.prodi.gy/t/how-can-i-set-prodigy-cookies-domain-separate-from-host-bind-address/5536/12 "2022-07-26T15:22:53Z")

</div>

I just tried running it locally and it all seems to work.

I start up the Docker container via:

```python
docker build -t prodiggity .
docker run -it -p 8888:8888 --entrypoint bash prodiggity

```

And then have it run:

```python
python -m prodigy textcat.manual dataset examples.jsonl --label a,b

```

With the following `prodigy.json`:

```python
{
    "port": 8888,
    "host": "0.0.0.0"
}

```

I'm unable to reproduce the warnings that you're seeing. So as long as the cookie warnings can be ignored, I would do that because they seem like they might be related to something that I cannot produce locally.

If it is a breaking issue, we could dive in further, but we'd need to think about how we might be able to get the error reproduced. Have you checked if this error persists on your colleague's machines or when you are on another network?

---

<div class="post-metadata">

**Author:** ![jb3k](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/jb3k/32/2889_2.png) [@jb3k](https://support.prodi.gy/u/jb3k)\
**Post date:** [July 28, 2022, 7:44pm UTC](https://support.prodi.gy/t/how-can-i-set-prodigy-cookies-domain-separate-from-host-bind-address/5536/13 "2022-07-28T19:44:09Z")

</div>

This is not a breaking issue. I was trying to fix the browser cookie error with a configuration option IFF the `_prodigy_` cookie was necessary. Sounds like the `_prodigy_` cookie is not necessary.