OpenID login intermittently fails with AADSTS90015 or 400 due to redirect_to accumulation
- Dominant language
- Python
- Stars
- 670
- Forks
- 183
- Avg merge
- 15h 13m
- Merged PRs (30d)
- 368
Description
## Environment
- WebUI: 26.4.8-rc.4
- Manager: 26.4.4rc5
- OpenID provider: Microsoft Entra ID (Azure AD)
- Site: dogbowl.cloud.backend.ai (HTTPS)
## Symptoms
OpenID login fails when attempted in the affected browser. The failure shows up in two alternating modes:
1. Some attempts get redirected to Microsoft and the MS authorize endpoint returns `AADSTS90015: Requested query string is too long`.
1. Other attempts return HTTP 400. The request body keys appear corrupted, e.g., `keys=['usernaHe', 'password']` — the `username` key has a single-character substitution to `usernaHe` (m -> H).
The affected request payload is encrypted (X-BackendAI-Encoded path).
Regular (non-OpenID) email/password login works correctly in the same browser at the same time.
The browser Location header to MS authorize endpoint contains a `state` parameter whose redirect field is the OpenID callback URL itself, with cascading percent-encoding (`%25` -> `%2525` -> `%252525` -> ...).
## Manager log (single occurrence, not reproducing)
```
Uncaught exception in HTTP request handlers (POST /openid/login): 'function' object has no attribute 'set'
File ".../ai/backend/manager/plugin/openid/webapp.py", line 292, in login
await valkey_client.set_openid_key(session_key, code_verifier)
File ".../ai/backend/manager/plugin/openid/valkey_client.py", line 90, in set_openid_key
await self._client.client.set(
AttributeError: 'function' object has no attribute 'set'
```
## Reproduction
1. Open WebUI in the affected browser, click OpenID login.
1. Complete Microsoft authentication.
1. Observe failure (90015 or 400). Failure persists across retries in the same browser.
## Observations
- Same flow works correctly in a different browser.
- In the affected browser, the failure persists after clearing site data (localStorage, cookies, cache, service workers via DevTools "Clear site data").
- The failure persists after logging out from login.microsoftonline.com.
JIRA Issue: BA-6111
Contributor guide
Assessment
This issue has not been assessed yet.