Apps Break When SecureIdentityPropagationToAppsEnabled Is True
Issue
A Domino App stops working after it is restarted on a deployment where the SecureIdentityPropagationToAppsEnabled feature flag is set to true. The app may have been functioning correctly before the restart or before the flag was enabled. The most common symptom is a routing or 404 error caused by a stale, manually constructed requests_pathname_prefix path that no longer matches the new routing structure. Typical symptoms include:- App loads a blank page or returns a 404/502 after restart
- Dash (Plotly) app fails to serve assets or callbacks
- The app was working before the flag was enabled or before the last restart
- The app code manually constructs the path prefix from DOMINO_PROJECT_OWNER, DOMINO_PROJECT_NAME, and DOMINO_RUN_ID environment variables
Cause
When SecureIdentityPropagationToAppsEnabled is true, Domino changes the URL routing structure used to proxy requests to a running app. Apps that manually construct the requests_pathname_prefix from individual environment variables (DOMINO_PROJECT_OWNER, DOMINO_PROJECT_NAME, DOMINO_RUN_ID) produce a path that no longer matches the new routing structure, causing request routing to fail. An app that is already running when the feature flag is enabled will continue to work until it is restarted. The breakage occurs on the next restart because the new routing structure takes effect at that point. The legacy path construction pattern that causes the issue:Resolution
Replace the manually constructed path prefix with the Domino-provided DOMINO_RUN_HOST_PATH environment variable. This variable is automatically set by Domino and always reflects the correct routing path for the current session, regardless of whether SecureIdentityPropagationToAppsEnabled is true or false.Step 1 — Locate the path prefix in your app code
Search your app’s entry point for any reference to requests_pathname_prefix that manually constructs the path from environment variables, for example:Step 2 — Replace with DOMINO_RUN_HOST_PATH
Update the code to read the path directly from the Domino-provided environment variable:Step 3 — Restart the app
Publish the updated code to your Domino project and restart the app. Verify that the app loads correctly and that callbacks and assets resolve without errors.Additional Notes
Important: If SecureIdentityPropagationToAppsEnabled is set to false and you need to allow anonymous (unauthenticated) access to Domino Apps, ensure the Central Config parameter com.cerebro.domino.launchpad.allowPublicModelProducts is also set to true. See KB article 000002243 for details.- Domino Cloud / 6.1.1+: The flag defaults to true. All new and existing apps should be updated to use DOMINO_RUN_HOST_PATH.
- Domino 6.0.x (self-managed): The flag defaults to false. No immediate action is required, but migrating to DOMINO_RUN_HOST_PATH is strongly recommended to avoid breakage during future upgrades.
- Non-Dash frameworks: Any Python web framework (Streamlit, Flask, etc.) that accepts an explicit base path or prefix should also be updated to read from DOMINO_RUN_HOST_PATH.