Skip to content

Set-Cookie Header is Split when using OIDC together with AWS Lambda #32037

@c-classen

Description

@c-classen

Describe the bug

I think I have a similar problem to #25580. I am trying to use the quarkus-oidc extension together with an AWS Lambda deployment using quarkus-amazon-lambda-http. When I remove the quarkus-amazon-lambda-http dependency from the project, everything works fine. However when it is included in the dependencies so the Mock Lambda Event Server is used in dev mode, the q_auth-Cookie breaks (in two parts).

This is part of the headers that Quarkus responds with:

< set-cookie: q_auth=6b6a7588-802f-49ea-a276-64e6bac263d1|/auth/authenticateAndRedirect?url=http%3A%2F%2Flocalhost%3A3000%2F; Max-Age=1800; Expires=Wed
< set-cookie: 22 Mar 2023 13:44:01 GMT; Path=/; HTTPOnly

As you can see, the comma that is used within the expiration value now is interpreted by the AWS Lambda Mock Server (and probably also the real one) as the separating character between two header values.

Expected behavior

No response

Actual behavior

No response

How to Reproduce?

Steps to reproduce:

  1. Go to https://code.quarkus.io, select "AWS Lambda HTTP" as well as "OpenID Connect" and download and extract the ZIP
  2. Change maven.compiler.release to 11 (probably not necessary, I just did not have the required java version installed)
  3. Add the following to the application.properties:
quarkus.oidc.application-type=web_app
# Enforce OIDC usage for all paths
quarkus.http.auth.permission.authenticated.paths=/*
quarkus.http.auth.permission.authenticated.policy=authenticated
  1. Run ./mvnw quarkus:dev
  2. Execute curl localhost:8080 -v

Now you can see two set-cookie headers, of which at least the second one looks broken

Output of uname -a or ver

No response

Output of java -version

No response

GraalVM version (if different from Java)

No response

Quarkus version or git rev

No response

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

No response

(edited to add missing reproduction step)

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions