{"action":"created","issue":{"url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/220","repository_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc","labels_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/220/labels{/name}","comments_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/220/comments","events_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/220/events","html_url":"https://github.com/pingidentity/mod_auth_openidc/issues/220","id":203870762,"number":220,"title":"XHRs resulting in 302 when they are configured for 401s","user":{"login":"phybros","id":1985132,"avatar_url":"https://avatars.githubusercontent.com/u/1985132?v=3","gravatar_id":"","url":"https://api.github.com/users/phybros","html_url":"https://github.com/phybros","followers_url":"https://api.github.com/users/phybros/followers","following_url":"https://api.github.com/users/phybros/following{/other_user}","gists_url":"https://api.github.com/users/phybros/gists{/gist_id}","starred_url":"https://api.github.com/users/phybros/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phybros/subscriptions","organizations_url":"https://api.github.com/users/phybros/orgs","repos_url":"https://api.github.com/users/phybros/repos","events_url":"https://api.github.com/users/phybros/events{/privacy}","received_events_url":"https://api.github.com/users/phybros/received_events","type":"User","site_admin":false},"labels":[{"id":88714459,"url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":31,"created_at":"2017-01-29T13:49:17Z","updated_at":"2017-02-07T13:59:19Z","closed_at":null,"body":"Hi, first off this module is awesome so thanks for maintaining it!\r\n\r\nWe use this to control access to an instance of Grafana which does not set the X-Requested-With header on any of its XHR requests. We use `OIDCSessionType client-cookie` and `OIDCSessionInactivityTimeout 86400` and have `OIDCUnAuthAction 401` set for the paths which use XHR requests which all works great.\r\n\r\nThe issue seems to be if you load up grafana, then go idle for some period of time (but still less than `OIDCSessionInactivityTimeout`) when you come back, all your browser cookies are filled up with `mod_auth_openidc_session_xxxxxxxxxxxxxxxxx` cookies and the next request you make will get a 400 from apache - complaining \"Cookie header was too long\".\r\n\r\nStill trying to narrow down exactly what is happening, but I did get a chrome developer tools capture of it happening (however it's full of sensitive info so I'm reluctant to share). Basically when I open my laptop, I see the browser making all it's usual XHRs but they start returning 302s instead of the 401s that are configured with `OIDCUnAuthAction 401`. Again: those paths DO return 401's if I simply delete my cookies and wait for the next set of requests, so I'm not sure if there's an if/else with a gap in it somewhere in the module.\r\n\r\nCurrently running 2.1.0, but about to test an upgrade to 2.1.4.\r\n\r\nAny insight would be greatly appreciated!"},"comment":{"url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/comments/278007253","html_url":"https://github.com/pingidentity/mod_auth_openidc/issues/220#issuecomment-278007253","issue_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/220","id":278007253,"user":{"login":"phybros","id":1985132,"avatar_url":"https://avatars.githubusercontent.com/u/1985132?v=3","gravatar_id":"","url":"https://api.github.com/users/phybros","html_url":"https://github.com/phybros","followers_url":"https://api.github.com/users/phybros/followers","following_url":"https://api.github.com/users/phybros/following{/other_user}","gists_url":"https://api.github.com/users/phybros/gists{/gist_id}","starred_url":"https://api.github.com/users/phybros/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phybros/subscriptions","organizations_url":"https://api.github.com/users/phybros/orgs","repos_url":"https://api.github.com/users/phybros/repos","events_url":"https://api.github.com/users/phybros/events{/privacy}","received_events_url":"https://api.github.com/users/phybros/received_events","type":"User","site_admin":false},"created_at":"2017-02-07T13:59:19Z","updated_at":"2017-02-07T13:59:19Z","body":"Aha! yes confirmed! If the XHR happens at a time greater than `OIDCSessionMaxDuration` but less than `OIDCSessionInactivityTimeout` the `302` bug happens and all those `_state` cookies get created.\r\n\r\nI will try the new module right now. And yes, reading back over the thread I see that I had tunnel vision and was only focusing on `OIDCSessionInactivityTimeout`, sorry about that!"}}
{"actor":{"display_login":"phybros"}}