> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domino.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Impact of Secure Identity Propagation Feature Flag on Domino Apps

> In Domino 6.1.1+, SecureIdentityPropagationToAppsEnabled defaults to true, breaking apps on restart if they manually construct requests_pathname_prefix. Fix by replacing the manual path with os.environ.get("DOMINO_RUN_HOST_PATH").

# Apps Break When SecureIdentityPropagationToAppsEnabled Is True

## Issue

A Domino App stops working after it is restarted on a deployment where the SecureIdentityPropagationToAppsEnabled feature flag is set to true. The app may have been functioning correctly before the restart or before the flag was enabled. The most common symptom is a routing or 404 error caused by a stale, manually constructed requests\_pathname\_prefix path that no longer matches the new routing structure.

**Typical symptoms include:**

* App loads a blank page or returns a 404/502 after restart
* Dash (Plotly) app fails to serve assets or callbacks
* The app was working before the flag was enabled or before the last restart
* The app code manually constructs the path prefix from DOMINO\_PROJECT\_OWNER, DOMINO\_PROJECT\_NAME, and DOMINO\_RUN\_ID environment variables

## Cause

When SecureIdentityPropagationToAppsEnabled is true, Domino changes the URL routing structure used to proxy requests to a running app. Apps that manually construct the requests\_pathname\_prefix from individual environment variables (DOMINO\_PROJECT\_OWNER, DOMINO\_PROJECT\_NAME, DOMINO\_RUN\_ID) produce a path that no longer matches the new routing structure, causing request routing to fail.

An app that is **already running** when the feature flag is enabled will continue to work until it is restarted. The breakage occurs on the next restart because the new routing structure takes effect at that point.

The legacy path construction pattern that causes the issue:

```
user    = os.environ.get("DOMINO_PROJECT_OWNER")
project = os.environ.get("DOMINO_PROJECT_NAME")
run_id  = os.environ.get("DOMINO_RUN_ID")

requests_pathname_prefix = f"/{user}/{project}/r/notebookSession/{run_id}/"
```

## Resolution

Replace the manually constructed path prefix with the Domino-provided DOMINO\_RUN\_HOST\_PATH environment variable. This variable is automatically set by Domino and always reflects the correct routing path for the current session, regardless of whether SecureIdentityPropagationToAppsEnabled is true or false.

### Step 1 — Locate the path prefix in your app code

Search your app's entry point for any reference to requests\_pathname\_prefix that manually constructs the path from environment variables, for example:

```
user    = os.environ.get("DOMINO_PROJECT_OWNER")
project = os.environ.get("DOMINO_PROJECT_NAME")
run_id  = os.environ.get("DOMINO_RUN_ID")
runurl  = f'/{user}/{project}/r/notebookSession/{run_id}/'

app = Dash(__name__, routes_pathname_prefix='/', requests_pathname_prefix=runurl)
```

### Step 2 — Replace with DOMINO\_RUN\_HOST\_PATH

Update the code to read the path directly from the Domino-provided environment variable:

```
runurl = os.environ.get("DOMINO_RUN_HOST_PATH")

app = Dash(__name__, routes_pathname_prefix='/', requests_pathname_prefix=runurl)
```

### Step 3 — Restart the app

Publish the updated code to your Domino project and restart the app. Verify that the app loads correctly and that callbacks and assets resolve without errors.

## Additional Notes

**Important:** If SecureIdentityPropagationToAppsEnabled is set to false and you need to allow anonymous (unauthenticated) access to Domino Apps, ensure the Central Config parameter com.cerebro.domino.launchpad.allowPublicModelProducts is also set to true. See KB article [000002243](https://support.domino.ai/support/s/article/We-are-no-longer-seeing-the-option-to-allow-anonymous-users-to-view-apps) for details.

* **Domino Cloud / 6.1.1+:** The flag defaults to true. All new and existing apps should be updated to use DOMINO\_RUN\_HOST\_PATH.
* **Domino 6.0.x (self-managed):** The flag defaults to false. No immediate action is required, but migrating to DOMINO\_RUN\_HOST\_PATH is strongly recommended to avoid breakage during future upgrades.
* **Non-Dash frameworks:** Any Python web framework (Streamlit, Flask, etc.) that accepts an explicit base path or prefix should also be updated to read from DOMINO\_RUN\_HOST\_PATH.

## Related Articles

* [000002243 — Anonymous user access to Domino Apps](https://support.domino.ai/support/s/article/We-are-no-longer-seeing-the-option-to-allow-anonymous-users-to-view-apps)
* [000001814 — Feature Flags in Domino](https://support.domino.ai/support/s/article/Feature-flags-1718868051921)
* [000002017 — Changing a specific user's feature flag](https://support.domino.ai/support/s/article/Changing-a-specific-user-s-feature-flag-1724943001691)


## Related topics

- [Troubleshooting](/knowledge-base/troubleshooting-overview.md)
- [Configuration settings for Apps](/cloud/platform-capabilities/features/apps/app-logs-and-versioning/app-configuration-settings.md)
- [App security and identity](/cloud/platform-capabilities/features/apps/authentication-and-identity/app-security.md)
- [Domino Cloud release notes](/release-notes/cloud-release.md)