search

bitly / oauth2_proxy

A reverse proxy that provides authentication with Google, Github or other provider
MIT License
5.1k stars 1.21k forks source link

Failed to decode session state on cooke expiration #596

Open Stono opened 6 years ago

Stono commented 6 years ago

Hey, We noticed that some people get stuck in a redirect loop when their cookie has expired.

Looking at the oauth2 proxy logs we see:

authentication complete Session{email:user@domain.com user: token:true}              127.0.0.1 - - [21/May/2018:14:41:14 +0000] app.mercury-admin-tool.dev.k8.atcloud.io GET - "/oauth2/callback?code=code&state=00dc209c3139cdf20fe284e5c948f394%3a%2f&session_state=4948b7da-6fea-4db4-8c9f-ef80553f4f4a" HTTP/1.1 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" 302 24 0.329
127.0.0.1 - - [21/May/2018:14:41:15 +0000] app.mercury-admin-tool.dev.k8.atcloud.io GET - "/oauth2/auth" HTTP/1.1 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" 401 21 0.000
2018/05/21 14:41:15 oauthproxy.go:616: 10.202.1.18:45930 ("127.0.0.1") could not decode session state: expected 2 chunks got 1

Any ideas?

Ps. I've noticed it's only when --set-xauthrequest is enabled