-
Notifications
You must be signed in to change notification settings - Fork 3k
Description
Describe the bug
I think I have a similar problem to #25580. I am trying to use the quarkus-oidc extension together with an AWS Lambda deployment using quarkus-amazon-lambda-http. When I remove the quarkus-amazon-lambda-http dependency from the project, everything works fine. However when it is included in the dependencies so the Mock Lambda Event Server is used in dev mode, the q_auth-Cookie breaks (in two parts).
This is part of the headers that Quarkus responds with:
< set-cookie: q_auth=6b6a7588-802f-49ea-a276-64e6bac263d1|/auth/authenticateAndRedirect?url=http%3A%2F%2Flocalhost%3A3000%2F; Max-Age=1800; Expires=Wed
< set-cookie: 22 Mar 2023 13:44:01 GMT; Path=/; HTTPOnly
As you can see, the comma that is used within the expiration value now is interpreted by the AWS Lambda Mock Server (and probably also the real one) as the separating character between two header values.
Expected behavior
No response
Actual behavior
No response
How to Reproduce?
Steps to reproduce:
- Go to https://code.quarkus.io, select "AWS Lambda HTTP" as well as "OpenID Connect" and download and extract the ZIP
- Change maven.compiler.release to 11 (probably not necessary, I just did not have the required java version installed)
- Add the following to the
application.properties
:
quarkus.oidc.application-type=web_app
# Enforce OIDC usage for all paths
quarkus.http.auth.permission.authenticated.paths=/*
quarkus.http.auth.permission.authenticated.policy=authenticated
- Run
./mvnw quarkus:dev
- Execute
curl localhost:8080 -v
Now you can see two set-cookie headers, of which at least the second one looks broken
Output of uname -a
or ver
No response
Output of java -version
No response
GraalVM version (if different from Java)
No response
Quarkus version or git rev
No response
Build tool (ie. output of mvnw --version
or gradlew --version
)
No response
Additional information
No response
(edited to add missing reproduction step)