Session ID or Cookie is Renewed or Cleared with External Authentication

mxhash commented 5 months ago

Describe the bug

When using Icinga Web 2 with external authentication via mod_auth_openidc, the session ID is renewed on every (or some) request. This behavior can lead to issues with CSRF token validation in other modules, such as the Director. The continuous renewal of session IDs prevents consistent validation of CSRF tokens, causing validation to fail and potentially disrupting functionality. However, Icinga Web forms, such as those for comments and downtimes, work without any issues

To Reproduce

Assuming Icinga Web 2 is configured with external authentication and the Director module is enabled, editing any entity in the Director will result in an exception due to CSRF token validation failure.

Expected behavior

Ensure forms are submitted without validation failures, especially in the Director module.

Screenshots

https://github.com/Icinga/icingaweb2/assets/2128679/05eec690-758b-4b50-a085-061ec8799ead

Take a look at the Icinga Web 2 cookie, which disappears on reload. This issue does not occur in the IcingaDB module.

Your Environment

Include as many relevant details about the environment you experienced the problem in

Icinga Web 2 version and modules (System - About): 2.12.1
Web browser used: Arc (Chrome Based)
Icinga 2 version used (icinga2 --version): r2.14.2-1
PHP version used (php --version): 7.4.3-4ubuntu2.22
Server operating system and version: 20.04.6 LTS (Focal Fossa)

Additional context

I am not sure if this issue is only related to the Director; it sometimes happens in the system views too.

aheinhold commented 1 month ago

Hi,

We are using Icingaweb2 with curl and the Ansible URI module to automatically set and delete downtimes.

Since migrating from the IDO to the icingadb, we are encountering an issue where downtimes are not being deleted. The following error occurs when trying to delete a downtime:

curl -H "Accept: application/json" -u user:password -X POST "https://icinga-server/icingaweb2/icingadb/downtimes/delete?host.name=hostname"
{"status":"error","message":"Invalid CSRF token provided"}

We would appreciate your assistance with this issue.

Here are the versions of our setup:

Icinga 2: r2.13.9-1
PHP: 7.2.24 (cli) (built: Oct 22 2019 08:28:36) ( NTS )
Icinga Web 2: 2.12.1

Looking forward to your support!

Regards, Alex

nilmerg commented 1 month ago

@aheinhold One of your colleagues already opened this.

mxhash commented 5 days ago

Still have that issue and I patched myself again after the security update.

Icinga / icingaweb2