A race condition in authentication flow causes occasional `Flow does not apply to current user.`

[mnixry]

Describe the bug

In the user login stage inside the authentication flow, a user may randomly be unable to log in, receiving an error message, “Flow does not apply to current user,” or encountering other similar issues. We discovered a race condition between frontend requests arriving at the backend that may cause this issue.

To Reproduce
Steps to reproduce the behavior:

1. Create an authentication source (e.g., Social Login via OIDC) and enable it, which corresponds to the default-source-authentication flow while authenticating.
2. Try to log in via this source multiple times or use tools to slow down requests to /api/v3/flows/executor/default-source-authentication/.
3. You will be declined by the flow, showing an error message indicating permission denied.

Expected behavior
Users should be able to log in normally.

Screenshots

1. Branding request responds with a delete cookie header:

   

2. API request after it will have NO session cookie, causing authentication invalidation:

   

Version and Deployment (please complete the following information):

• authentik version: 2024.8.3
• Deployment: docker-compose

Additional context

After debugging, we found the following condition may trigger this issue:

1. Django cycles session_key once the user logs in, which purges the old session_key in cache storage.
2. Requests sent earlier arrive at the server later with an old session token with a cycled sid, causing the cache storage to not find the corresponding sid.
3. The server finds the session cookie exists but is not valid since the corresponding key is purged; it returns a delete_cookie header which removes the session cookie.
4. Once the request above arrives, the user session will be logged out immediately, even if they have completed the user login stage, which fails the subsequent request to /api/v3/flows/executor/default-source-authentication/.

References:

• https://github.com/django/django/blob/6765b6adf924c1bc8792a4a454d5a788c1abc98e/django/contrib/sessions/backends/base.py#L426-L435

• authentik/authentik/root/middleware.py

  Lines 84 to 91 in 0804179

  	if settings.SESSION_COOKIE_NAME in request.COOKIES and empty:
  	response.delete_cookie(
  	settings.SESSION_COOKIE_NAME,
  	path=settings.SESSION_COOKIE_PATH,
  	domain=settings.SESSION_COOKIE_DOMAIN,
  	samesite=same_site,
  	)
  	patch_vary_headers(response, ("Cookie",))

• authentik/authentik/stages/user_login/stage.py

  Lines 97 to 102 in 0804179

  	with audit_ignore():
  	login(
  	self.request,
  	user,
  	backend=backend,
  	)

• https://github.com/django/django/blob/6765b6adf924c1bc8792a4a454d5a788c1abc98e/django/contrib/auth/__init__.py#L114-L126

Currently, the workaround for this issue is under exploration.

[BeryJu]

We haven't run into this issue ourselves or have observed it even on larger rollouts

[mnixry]

We haven't run into this issue ourselves or have observed it even on larger rollouts

Thank you for reviewing the issue.

While this issue is not common on my end, it does occur under certain network conditions, such as when early requests arrive late to the server (as explained in the "Additional Context" section). You might be able to reproduce this issue by manually delaying some requests. Contributing factors may include network delay, the HTTP protocol version (h11, h2, or h3), and server performance.

Our code review above has confirmed the presence of the race, despite its infrequency. As a workaround, we have removed the Set-Cookie response from the branding and config endpoints, which has effectively mitigated the problem.

P.S. There are numerous issues describing the "Flow does not apply to current user," and it's possible that some of them are caused by this issue.

[j-z10]

We encountered the same issue, but we didn't realize it was caused by other requests. Initially, we mistakenly attributed it to a bug in Chromium. Here's the related issue for reference: Chromium Bug.
@mnixry, fantastic work! Do you have a PR for this fix? I'd love to implement it temporarily in our environment first.
@BeryJu, hopefully, we can get this resolved soon!

[mnixry]

Do you have a PR for this fix? I'd love to implement it temporarily in our environment first.

@j-z10 Unfortunately no. Addressing this issue may require structural changes to the login implementation, such as adding locks, since it is a "data race" bug.

---

However, I have found a workaround that mitigates the problem on my side.

The mitigation is implemented using Cloudflare Rules, but these rules are simple and should be applicable to any HTTP servers acting as the reverse proxy for Authentik.

[Guyao146]

Hi，I have a same question.Include logining with Microsoft Entra.Will be Flow does not apply to current user.But when I use to admin account,prompt Flow does not apply to current user later,I will enter I want to enter web.Use dont have permission account,I cant enter.
So,I think it is a prompt bug?