OIDC extend cookie max age to 10 minutes and redirect to login page when no session #5614

server/Auth.js

@@ -216,14 +216,15 @@ class Auth {
    * @returns {Object|null} - Returns error object if validation fails, null if successful
    */
   paramsToCookies(req, res, authMethod = 'local') {
-    const TWO_MINUTES = 120000 // 2 minutes in milliseconds
+    // Cookie max age in milliseconds
+    const TEN_MINUTES = 10 * 60 * 1000
     const callback = req.query.redirect_uri || req.query.callback
 
     // Additional handling for non-API based authMethod
     if (!this.isAuthMethodAPIBased(authMethod)) {
       // Store 'auth_state' if present in the request
       if (req.query.state) {
-        res.cookie('auth_state', req.query.state, { maxAge: TWO_MINUTES, httpOnly: true })
+        res.cookie('auth_state', req.query.state, { maxAge: TEN_MINUTES, httpOnly: true })
       }
 
       // Validate and store the callback URL
@@ -239,7 +240,7 @@ class Auth {
         return { error: 'Invalid callback URL - must be same-origin' }
       }
 
-      res.cookie('auth_cb', callback, { maxAge: TWO_MINUTES, httpOnly: true })
+      res.cookie('auth_cb', callback, { maxAge: TEN_MINUTES, httpOnly: true })
     }
 
     // Store the authentication method for long
@@ -273,7 +274,8 @@ class Auth {
         // TODO: Temporarily continue sending the old token as setToken
         res.redirect(302, `${req.cookies.auth_cb}?setToken=${userResponse.user.token}&accessToken=${userResponse.user.accessToken}${stateQuery}`)
       } else {
-        res.status(400).send('No callback or already expired')
+        Logger.error('[Auth] No callback or already expired')
+        res.redirect(`/login?error=${encodeURIComponent('No callback or already expired')}&autoLaunch=0`)
       }
     }
   }
@@ -385,7 +387,13 @@ class Auth {
         const sessionKey = this.oidcAuthStrategy.getStrategy()._key
 
         if (!req.session[sessionKey]) {
-          return res.status(400).send('No session')
+          // Mobile clients send code_verifier and expect a status, not the web login page
+          const isMobile = req.cookies.auth_method === 'openid-mobile' || !!req.query.code_verifier
+          Logger.error('[Auth] /auth/openid/callback route: No session')
+          if (isMobile) {
+            return res.status(400).send('No session')
+          }
+          return res.redirect(`/login?error=${encodeURIComponent('No sign-in session')}&autoLaunch=0`)
         }
 
         // If the client sends us a code_verifier, we will tell passport to use this to send this in the token request