search

vmware-archive / gangway

An application that can be used to easily enable authentication flows via OIDC for a kubernetes cluster.
Apache License 2.0
409 stars 111 forks source link

securecookie: the value is not valid error #120

Closed rk295 closed 5 years ago

rk295 commented 5 years ago

Hi, I'm running Gangway 3.0.0 authenticating from Keycloak and seeing an occasional error.

The steps we think are needed to reproduce is as follows:

  1. Visit gangway
  2. Click Sign in
  3. Successfully get redirected to Keycloak
  4. Successfully authenticate with Keycloak
  5. Get redirected back to gangway
  6. All is well, the user can get their kubectl config etc. No problems.

Now if they don't use gangway or kubernetes for a period (a week in my test instance) and then visit the Gangway page, as soon as they click "sign in" they receive the error:

securecookie: the value is not valid

When this occurred this morning I checked the cookies and noticed 3 from gangway:

The first two were created Tue, 05 Mar 2019 at 09:55:55, the last a little earlier at 09:55:20.

When I revisited the gangway site and saw the error was approximately Tue, 12 Mar 2019 13:14:10.

Deleting all three cookies, and reloading the gangway home page allowed me to sign in successfully and get my kubectl config.

alexbrand commented 5 years ago

@rk295 Is it at all possible that the SESSION_SECURITY_KEY changed between the time the initial cookies were obtained and the moment when the error occurs?

rk295 commented 5 years ago

Thats a good thought, we are using a helm chart to handle deployments. Let me look back through the history and check what happens when we upgrade a deployment and when the last one was.

rk295 commented 5 years ago

I think you are right @alexbrand our helm chart was regenerating that key on each upgrade to the deployment. I've fixed it in the chart and things look ok now. Given that all the evidence points to this being fixed by that I'm going to close out this issue.

Thanks!

alexbrand commented 5 years ago

Excellent. Thanks @rk295

rk295 commented 5 years ago

I meant to say, the helm chart is ready and we'll hopefully get it PR'ed into helm/charts soon, some internal process to go through first. Until then, its here any comments appreciated!