Deploy browser apps with user sessions

The Console and Investor portal can use separate public hosts. A browser app with a host-only session cookie must serve the Platform API on its own origin so the cookie reaches the server-rendered pages that check it. Mount the SDK's createDalpProxy at the app's /api and /dalp routes when wiring such an app, and forward those paths to the private Platform API service.

Set DAPI_INTERNAL_URL in each app deployment, for example http://dalp-api:3001. Set the public app URL separately (global.dalpApp.config.app.http.url for the Console and INVESTOR_PORTAL_URL for the Investor portal). Do not set a public DAPI_URL for the browser: the browser calls the app origin, and the server forwards the request internally.

HelmCopy Anchor Link

The chart's Investor portal environment contains DAPI_INTERNAL_URL and passes the trusted edge profile through TRUSTED_PROXY_PROFILE. Keep the profile aligned with the ingress or gateway that overwrites forwarding headers. The Console applies the same profile from global.dalpApp.config.trustedProxy.profile. Set the portal's public URL once, in global.dalpApp.env.INVESTOR_PORTAL_URL: the chart passes it to the portal container and lists it as a Portal origin in the Platform API.

global:
  dalpApp:
    env:
      INVESTOR_PORTAL_URL: "https://portal.example"
investorPortal:
  enabled: true
  env:
    - name: DAPI_INTERNAL_URL
      value: "http://dalp-api:3001"

INVESTOR_PORTAL_URL was called CLIENT_PORTAL_URL in earlier releases. This release still reads the old name when the new one is unset, and warns about it. The next release no longer reads it.

Deploy the Console and Portal hosts as separate routes if your topology needs it. A proxy configured as shown preserves Set-Cookie, event streams, and auth-surface headers, and stamps the app origin when a server-side request has no Origin.

OpenShiftCopy Anchor Link

Apply the normal OpenShift overlay and set the public Route host for each app. The Portal still uses its in-cluster DAPI_INTERNAL_URL; it does not need a Platform API Route. Keep the investorPortal.env URL private and set global.dalpApp.env.INVESTOR_PORTAL_URL to the public Portal host. The OpenShift install page lists the Route and network-policy checks.

Sign-in returns to loginCopy Anchor Link

A successful sign-in followed by a login page usually means the cookie was issued by a different host. Check that the browser request is /api/auth/sign-in/email on the app host and that the response's Set-Cookie has no public DAPI host. Mount createDalpProxy at /api, remove DAPI_URL, and retry after clearing the old cookie.

See browser apps with user sessions for the handler example and the forwarding rules.