Open carleshf opened 3 years ago
@carleshf Facing a similar issue... Did you ever came up with a work-around?
Unfortunately, no.
On Sun, Jan 30, 2022 at 20:29 PT @.***> wrote:
@carleshf https://github.com/carleshf Facing a similar issue... Did you ever came up with a work-around?
— Reply to this email directly, view it on GitHub https://github.com/puiterwijk/flask-oidc/issues/111#issuecomment-1025213349, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAPTRZACZAWXXNPRNMLCAPTUYWGQNANCNFSM4SFZGDDA . You are receiving this because you were mentioned.Message ID: @.***>
-- Carles Hernadez-Ferrer www.carleshf.com
Thanks for your swift reply!
Hello @carleshf @P-T-I
I had the same problem. I solved it because it keycloak generate cookie (from an other domain) and my cookie policy was same-site="strict.
So, try to set Same-Site to None ?
Bug description
There is no CSRF set on session, then the
_process_callback
is failing when checking:To Reproduce
Minimal python code for a flask server to reproduce the error:
The
welcome.html
has a form with a link to the "admin" page, wich needs authentication:Expected behavior
I think that, somehow, before the
require_login
the library should set a CSRF token in session used by_process_callback
.Screenshots
Screenshot-1: Checking the content of both![Screenshot-1](https://user-images.githubusercontent.com/2046180/95185126-9b94b580-07c8-11eb-980c-c8952a0140e0.png)
csrf_token
andsession_csrf_token
.Screenshot-2: Location of the breakpoint in![Screenshot-2](https://user-images.githubusercontent.com/2046180/95185131-9d5e7900-07c8-11eb-905b-5ddb5b28dc9f.png)
flask_oidc
:Desktop:
cryptography==2.9.2
Flask==1.1.2
Flask-Cors==3.0.8
Flask-Login==0.5.0
flask-oidc==1.4.0
flask-restplus==0.13.0
httplib2==0.18.1
oauth2client==4.1.3
PyJWT==1.6.4
requests==2.23.0
rsa==4.6
urllib3==1.25.9
Werkzeug==0.16.1