WebUI: append port to session cookie name

[dyseg]

Prevents overwriting the shared cookie between qBt sessions on the same host.
Separated from #21618. Original topic: #20873 (comment)

[glassez]

The issue of multiple qBittorrent instances under the same host was already fixed by implementing suggestion of allowing you to set custom cookie name.
Original Issue is #18329. Fixed by #18384.

[dyseg]

In this case from my side this PR can be closed.

[Piccirello]

It would be really nice to fix the multi-instance scenario for users without requiring them to manually configure a custom cookie name. I suspect most users are not aware of this footgun, and so having a comprehensive fix will also prevent these users from opening GitHub issues unnecessarily.

[Piccirello]

An alternative would be to come up with a unique cookie name on startup.

[glassez]

IMO, the current method looks better, since it still identifies the cookie name with a specific qBittorrent instance, so that some client with a smarter implementation than browsers (which is why the problem is) could even send it to a specific instance and not to everyone on the same host.

[glassez]

It would be really nice to fix the multi-instance scenario for users without requiring them to manually configure a custom cookie name. I suspect most users are not aware of this footgun, and so having a comprehensive fix will also prevent these users from opening GitHub issues unnecessarily.

It's reasonable.
But shouldn't it then completely replace the current solution with a manually set name? It hardly makes much sense to have both of them at the same time.

[Piccirello]

It's reasonable. But shouldn't it then completely replace the current solution with a manually set name? It hardly makes much sense to have both of them at the same time.

Yes, I think having this would eliminate the need for setting a custom cookie name.

[dyseg]

Btw, chances are high, that other web applications name their session cookie also as SID. One example: gerbera/gerbera#2058 (comment)
And I'm sure that a quick github search would reveal more.
Even if the dynamic cookie name is not introduced, the default name could be changed to something which is unlikely to conflict with other webapps on the same host, path.

[Piccirello]

Btw, chances are high, that other web applications name their session cookie also as SID. One example: gerbera/gerbera#2058 (comment) And I'm sure that a quick github search would reveal more. Even if the dynamic cookie name is not introduced, the default name could be changed to something which is unlikely to conflict with other webapps on the same host, path.

This is a good point. This PR switches the static portion of the name to QBT_SID, which should handle that.

[Chocobo1]

Suggested change

	m_sessionCookieName = DEFAULT_SESSION_COOKIE_NAME + QString::number(m_webUiPort);
	m_sessionCookieName = DEFAULT_SESSION_COOKIE_NAME + QString::number(Preferences::instance()->getWebUIPort());