search

goauthentik / authentik

The authentication glue you need.
https://goauthentik.io
Other
13.67k stars 916 forks source link

Authenik session cookie expires value changes from timestamp to "Session" and requires reauthentication after few hours #12009

Open raulk89 opened 1 week ago

raulk89 commented 1 week ago

We have noticed an issue in authentik 2024.10.x version where we need to reauthenticate again for every ~2-3 hours. Initially we had session cookie set to expire after 1 day. But now we changed it to 5 days. Nothing changes. Our session cookie still expires after few hours.

I noticed that on web browser (Edge), the session cookie expires value changes from timestamp to "Session". It probably has something to do with it perhaps. After I reauthenticate again, then the session cookie value changes back to timestamp value.

The issue started after we ugprade to 2024.10.0 We came from 2024.8.3 and everything was working fine until we did the ugprade. We tried 2024.10.1 version as well, and we encountered the same issue.

I will upload the screenshot as well.

authentik_issue

Deployment type: helm

Regards Raul

tograss commented 1 week ago

Hi, please see #11436 . I think it might be the same bug. I noticed exact the same behavior

raulk89 commented 1 week ago

Hmm, thanks. Seems like the same issue.

I refreshed the authentik page, my session was still working. Then we executed the ldap_sync, I did the refresh on that authentik page, and it asks for reauthenticating. So seems like ldap_sync ise the issue yes.

According to this, by disabling the ldap_sync is also a workaround, yes ?

But what is strange, for us it worked like a charm in 2024.8.3 One thing to note. On 27-th of October, we had time change as well due to DST (Daylight Savings Time). Before we were UTC +3 After 27-th of October we are on UTC+2

We may have been upgrading the authentik at the same time (not 100% about that). So that is why we thought it was due to the upgrade.

But when it is due to the time difference, can it be DST related or not possible at all ?

Raul