Repository navigation
Issue with CookieTokenStore delimiter #10025
Replies: 2 comments 3 replies
|
@hmlnarik @pedroigor Whats your take on this? |
|
IIRC, this is the second time we have a similar issue with the delimiter we use in cookies. See https://issues.redhat.com/browse/KEYCLOAK-1163. TBH, I would just provide a configuration option and avoid this popping out every time someones find an issue. We are planning to deprecate adapters too and I'm not sure if we are going to make changes like that. |
|
+1 for the configuration option for this with keep the defaults as is (as I am not 100% sure about other side-effects of changing this like backwards compatibility etc...) IMO this will be community contribution And as @pedroigor mentioned, it should be noted that adapters are going to be deprecated/removed (some of them already are). |
|
@pedroigor Thank you very much for the feedback! |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
We have an issue with CookieTokenStore and the string it uses as a delimiter when it combines together the access token, ID token and refresh token strings to store in a cookie.
In our environment, the cookie parsing break every few hundred updates of the refresh token due to this.
Currently the delimiter is set to ”” (three underscores). These tokens are all Base64Url encoded, which means that the underscore is a valid character in the encoded string. This can lead to that the signature part of the tokens can have ”” in them, or have another underscore adjacent to the delimiter, breaking the parsing of the cookie.
We suggest that the delimiter string is changed to a character that is not a valid character in the Base64Url encoding but still adheres to RFC 6265 for allowed characters in a cookie value, for example !, + or &.
This seems to works for us (below a git diff), can you see any downside?
NOTE: Set the settings to reproduce:
- always-refresh-token=true
- token-store=cookie
All reactions