envoyproxy / envoyproxy/gateway
OIDC: Redirect loop of OIDC Authentication due to the cookie length limit
- Dominant language
- Go
- Stars
- 3k
- Forks
- 864
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 148
Description
*Description*:
> In the OIDC Authentication workflow, the access token is returned to Envoy Proxy through the callback URL. The response instructs the browser to store the tokens in cookies, which are used in subsequent requests.
> However, if the length of the token exceeds 4096 characters, the browser does not set the cookie and the authentication workflow restarts, resulting in a loop and the "too many redirects" error. Envoy logs no errors. IDP logs multiple successful logins within a few seconds.
Envoy Proxy should check the length of the tokens. Tokens can be compressed or can be split among multiple cookies.
*Repro steps*:
> Configure the application or user in IDP to return a long token, for example, by adding groups.
*Environment*:
> Envoy Gateway 1.5.2, Kubernetes v1.33.4
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.