You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "emil191995 (via GitHub)" <gi...@apache.org> on 2025/06/22 22:30:21 UTC
[I] bug: openid connect error when 2tabs are open [apisix]
emil191995 opened a new issue, #12360:
URL: https://github.com/apache/apisix/issues/12360
### Current Behavior
When I have 2 tabs of my app that redirected to login page and I login in first app second automaticaly redirects to redirect uri and returns 500 error for that page
### Expected Behavior
the second need to redirect my app page without 500 error
I debuged and found the issue.
in library openidc when first tab logs in it ends the session and when second comes to redirect_uri page it can not find the session state with the args in request uri cos it is already expired. so the way I solwed in my side is this
`
if err then
if session then
session:close()
end
if err == "unauthorized request" then
if conf.unauth_action == "pass" then
return nil
end
return 401
end
if err == "state from argument does not match state restored from session" then
ngx.redirect(url)
return nil
end
core.log.error("OIDC authentication failed: ", err)
return 500
end`
### Error Logs
_No response_
### Steps to Reproduce
run apisix via docker image
create route with plugin openid connect (I use keycloak as identity server)
open 2 tabs of your app
login in first
second redirects to redirect_uri
### Environment
- APISIX version (run `apisix version`):
- Operating system (run `uname -a`):
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`):
- etcd version, if relevant (run `curl http://127.0.0.1:9090/v1/server_info`):
- APISIX Dashboard version, if relevant:
- Plugin runner version, for issues related to plugin runners:
- LuaRocks version, for installation issues (run `luarocks --version`):
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: openid connect error when 2tabs are open [apisix]
Posted by "AndreaVida (via GitHub)" <gi...@apache.org>.
AndreaVida commented on issue #12360:
URL: https://github.com/apache/apisix/issues/12360#issuecomment-3056145993
Yes, as I already explained in my previous comment: `due to lua-resty-openidc library being unable to handle the state of 2 or more concurrent login sessions from different tabs of the same browser (see https://github.com/zmartzone/lua-resty-openidc/issues/482)`.
However, Apisix could help mitigating the effect of this issue as I suggested before: `what apisix openid-plugin can do in this case is to catch the error coming from the library and redirect the browser to the originally requested redirect_uri`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: openid connect error when 2tabs are open [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #12360:
URL: https://github.com/apache/apisix/issues/12360#issuecomment-2995320126
I follow this guide and see a 500 error after login, error log:
```
2025/06/23 07:45:41 [error] 119#119: *14160 [lua] openidc.lua:1484: authenticate(): request to the redirect_uri path but there's no session state found, client: 192.168.97.1, server: _, request: "GET /anything/callback?state=3d30e8a771ad687b64aef36000b6b092&session_state=3260ed80-99d7-4d70-ad7c-a9c5edd64e7a&code=d3585cc3-7bb9-4ff6-b17e-0f2a8978f600.3260ed80-99d7-4d70-ad7c-a9c5edd64e7a.93c5f12d-e980-44ba-9d22-dbaa2dcc6042 HTTP/1.1", host: "localhost:9080"
2025/06/23 07:45:41 [error] 119#119: *14160 [lua] openid-connect.lua:680: phase_func(): OIDC authentication failed: request to the redirect_uri path but there's no session state found, client: 192.168.97.1, server: _, request: "GET /anything/callback?state=3d30e8a771ad687b64aef36000b6b092&session_state=3260ed80-99d7-4d70-ad7c-a9c5edd64e7a&code=d3585cc3-7bb9-4ff6-b17e-0f2a8978f600.3260ed80-99d7-4d70-ad7c-a9c5edd64e7a.93c5f12d-e980-44ba-9d22-dbaa2dcc6042 HTTP/1.1", host: "localhost:9080"
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: openid connect error when 2tabs are open [apisix]
Posted by "mhammoudoddo (via GitHub)" <gi...@apache.org>.
mhammoudoddo commented on issue #12360:
URL: https://github.com/apache/apisix/issues/12360#issuecomment-3116764028
> Yes, as I already explained in my previous comment: _due to lua-resty-openidc library being unable to handle the state of 2 or more concurrent login sessions from different tabs of the same browser (see [zmartzone/lua-resty-openidc#482](https://github.com/zmartzone/lua-resty-openidc/issues/482))_.
>
> However, Apisix could help mitigating the effect of this issue as I suggested before: _what apisix openid-plugin can do in this case is to catch the error coming from the library and redirect the browser to the originally requested redirect_uri_.
>
> Since the error happens only at the end of the auth process, the user is in fact already logged in and redirecting the browser to any page works fine; IMHO returning a 500 error page in this case may not be be the best UX possible.
>
> In my setup I was able to work it around with this rule:
>
> "response-rewrite": {
> "_meta": {
> "disable": false,
> "filter": [
> "AND",
> ["uri", "~~", "^/callback$"],
> ["status", "==", 500]
> ]
> },
> "status_code": 307,
> "headers": {
> "set": {
> "Location": "/"
> }
> }
> }
> But unfortunately I do not have the exact `redirect_uri` available here and this would catch any 500 error from that page which is not so precise compared to catching the error in the code.
Hello ,
Could you please provide me the full config ? i'm having the same issue and i want a workaround
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: openid connect error when 2tabs are open [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #12360:
URL: https://github.com/apache/apisix/issues/12360#issuecomment-3006956432
Hi @AndreaVida, can you provide a detailed reproduction process?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: openid connect error when 2tabs are open [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #12360:
URL: https://github.com/apache/apisix/issues/12360#issuecomment-3056137726
I think this is a problem with the underlying library and has nothing to do with APISIX.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: openid connect error when 2tabs are open [apisix]
Posted by "AndreaVida (via GitHub)" <gi...@apache.org>.
AndreaVida commented on issue #12360:
URL: https://github.com/apache/apisix/issues/12360#issuecomment-3003864088
Hi, I got the same issue as well, which I think is due to `lua-resty-openidc` library being unable to handle the state of 2 or more concurrent login sessions (see [lua-resty-openidc/issues/482](https://github.com/zmartzone/lua-resty-openidc/issues/482)).
When this happens apisix logs show those errors:
```
2025/06/23 15:04:32 [error] 51#51: *125572 [lua] openidc.lua:1106: authenticate(): state from argument: 0719c5fc06a12354487e0a531b31689c does not match state restored from session: 065c3b3ba7625fafe9e670355571841a, client: 10.42.0.3, server: _, request: "GET /callback?state=0719c5fc06a12354487e0a531b31689c&session_state=b0648d29-742a-4c7b-b0d6-6bb07dd0988f&iss=https%3A%2F%2Fportal.10.60.66.58.nip.io%3A31390%2Fauth%2Frealms%2Fmaster&code=1a4bc137-6c1c-4b2c-b92e-da93568e4a72.b0648d29-742a-4c7b-b0d6-6bb07dd0988f.3001bb42-4e21-4549-9201-b285c591db20 HTTP/1.1", host: "portal.10.60.66.58.nip.io:31390"
2025/06/23 15:04:32 [error] 51#51: *125572 [lua] openid-connect.lua:588: phase_func(): OIDC authentication failed: state from argument does not match state restored from session, client: 10.42.0.3, server: _, request: "GET /callback?state=0719c5fc06a12354487e0a531b31689c&session_state=b0648d29-742a-4c7b-b0d6-6bb07dd0988f&iss=https%3A%2F%2Fportal.10.60.66.58.nip.io%3A31390%2Fauth%2Frealms%2Fmaster&code=1a4bc137-6c1c-4b2c-b92e-da93568e4a72.b0648d29-742a-4c7b-b0d6-6bb07dd0988f.3001bb42-4e21-4549-9201-b285c591db20 HTTP/1.1", host: "portal.10.60.66.58.nip.io:31390"
2025/06/23 15:04:32 [warn] 51#51: *125572 [lua] plugin.lua:1174: run_plugin(): openid-connect exits with http status code 500, client: 10.42.0.3, server: _, request: "GET /callback?state=0719c5fc06a12354487e0a531b31689c&session_state=b0648d29-742a-4c7b-b0d6-6bb07dd0988f&iss=https%3A%2F%2Fportal.10.60.66.58.nip.io%3A31390%2Fauth%2Frealms%2Fmaster&code=1a4bc137-6c1c-4b2c-b92e-da93568e4a72.b0648d29-742a-4c7b-b0d6-6bb07dd0988f.3001bb42-4e21-4549-9201-b285c591db20 HTTP/1.1", host: "portal.10.60.66.58.nip.io:31390"
```
The user instead gets a 500 error returned from /callback endpoint call:
`GET https://portal.10.60.66.58.nip.io:31390/callback?state=0719c5fc06a12354487e0a531b31689c&session_state=b0648d29-742a-4c7b-b0d6-6bb07dd0988f&iss=https%3A%2F%2Fportal.10.60.66.58.nip.io%3A31390%2Fauth%2Frealms%2Fmaster&code=1a4bc137-6c1c-4b2c-b92e-da93568e4a72.b0648d29-742a-4c7b-b0d6-6bb07dd0988f.3001bb42-4e21-4549-9201-b285c591db20`
However, the user is actually already logged in despite the error so redirecting the browser to a valid page is enough to bypass it.
IMHO what apisix can do in this case is to catch the error coming from the library and redirect the browser to the originally requested redirect_uri; I believe in most of the cases this will work fine and transparently.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: openid connect error when 2tabs are open [apisix]
Posted by "AlinsRan (via GitHub)" <gi...@apache.org>.
AlinsRan closed issue #12360: bug: openid connect error when 2tabs are open
URL: https://github.com/apache/apisix/issues/12360
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: openid connect error when 2tabs are open [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #12360:
URL: https://github.com/apache/apisix/issues/12360#issuecomment-2995235555
Hi @emil191995, can you provide your error logs?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: openid connect error when 2tabs are open [apisix]
Posted by "AndreaVida (via GitHub)" <gi...@apache.org>.
AndreaVida commented on issue #12360:
URL: https://github.com/apache/apisix/issues/12360#issuecomment-3095751420
For example see this comment: https://github.com/zmartzone/lua-resty-openidc/issues/482#issuecomment-1797962568
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org