Infinite authentication loop

[hanikesn]

With 1.2.3 the encrypted id_token is saved in the session data (#29). This pushes the session cookie size above 4 kb with e.g. Azure Active Directory and thus the cookie will not be stored by most browsers.

Possible workarounds are to use a different session store. Using a gzip based session encoder might also be an option.

[hanikesn]

Compressing the cookie with gzip brought it down to 3822 bytes. Maybe it makes sense to split it up into multiple cookies.

[zandbelt]

That is a fair suggestion: I've done something similar for mod_auth_openidc in the past; OpenIDC/mod_auth_openidc#153

[iperdomo]

I just got hit by this issue while trying to make a sample using lua-resty-openidc & Keycloak. A full debug log of the infinite redirect can be found at:
https://gist.github.com/iperdomo/3a0a6401000b07cddf9737e4ec8aadd0

I didn't realize that was to the fact that the cookie was too big and browser won't store it.

[zandbelt]

Ok, thanks for chiming in; on the short term I'll look to issue a clear warning about size limits, on the mid-term I'll implement chunked cookies. Of course PRs are welcome...

[bungle]

@hanikesn / @iperdomo

I have now implemented chunked cookie support in lua-resty-session that this lua-resty-openidc depends on.

Just grab the latest session.lua from here:
https://github.com/bungle/lua-resty-session/blob/master/lib/resty/session.lua

Also you may need to add something like this to your nginx.conf:

large_client_header_buffers 4 16k;

[iperdomo]

@bungle thanks for your support. I patched my example with the code at rev 67b8354 and I can confirm that the infinite loop is gone. In my case the cookie was chunked in 2 pieces.

[zandbelt]

Same thing for me, a quick test works; I got my - artificially enlarged - session cookie split across 4 Set-Cookie headers and they were all provided and assembled back from a single Cookie header in the subsequent request.

[bungle]

@iperdomo / @zandbelt,

Thank you for further testing this out. I will soon prepare a new release of lua-resty-session that has a support for chunked cookies.

[zandbelt]

@bungle @iperdomo thanks; closing the issue here now