envoyproxy / envoyproxy/gateway

OIDC: Redirect loop of OIDC Authentication due to the cookie length limit

Open
#7,315 17 comments 9 reactions 0 assignees View on GitHub
kind/bug
Dominant language
Go
Stars
3k
Forks
864
Avg merge
1d 22h
Merged PRs (30d)
148

Description

*Description*:

> In the OIDC Authentication workflow, the access token is returned to Envoy Proxy through the callback URL. The response instructs the browser to store the tokens in cookies, which are used in subsequent requests.
> However, if the length of the token exceeds 4096 characters, the browser does not set the cookie and the authentication workflow restarts, resulting in a loop and the "too many redirects" error. Envoy logs no errors. IDP logs multiple successful logins within a few seconds.

Envoy Proxy should check the length of the tokens. Tokens can be compressed or can be split among multiple cookies.

*Repro steps*:
> Configure the application or user in IDP to return a long token, for example, by adding groups.

*Environment*:
> Envoy Gateway 1.5.2, Kubernetes v1.33.4

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.