starred/godoxy-yusing
1
0
Fork 0
mirror of https://github.com/yusing/godoxy.git synced 2026-01-14 07:33:36 +01:00
Code Issues 18 Packages Projects Releases 10 Wiki Activity

"missing state cookie" error when OIDC is involved #53

New Issue
Closed
opened 2025-12-29 14:23:29 +01:00 by adam · 8 comments
adam commented 2025-12-29 14:23:29 +01:00
Owner
Copy Link

Originally created by @reddwarf666 on GitHub (Apr 2, 2025).

My setup I think you know but I'll list it so others are aware:

  • Docker
  • Cloudflare DNS
  • Godoxy 10.0
  • Authentik 2025.2.2

This all seems to work fine on whatever browser I use on my desktop.
Except when I use Firefox and/or Chrome on IOS, then I get a message "missing state cookie".

The procedure is to:

  1. Navigate to a self hosted service
  • cyberchef.domain.com or it-tools.domain.com for example
  1. Authentik shows and I need to login
  2. I return to a blank page with only the message "missing state cookie"

Out of all the components I use I have. no clue which one is responsible for this, if any at all tbh.
This could be related to the IOS platform or the browsers themselves.
And the odd thing is, if I try Safari on IOS it works as expected, I get to the service(s) just fine

So I realize this might entirely unrelated to Godoxy but I am at my wits end on how to solve this. My only reasoning to make a issue here with Godoxy is that it is one of the components serving the service to the browser(s) so this is my hail mary and see if you or someone else has a clue on what might be wrong and how to fix this.

Looking at the logs of Godoxy is see no record of this request it seems

Looking at the logs of Authentik I see no obvious issues

I transferred the browser page in IOS to my desktop (handover) and I see the it-tools page but with this message:

404 Not Found
Sorry, this page does not seem to exist
Maybe the cache is doing tricky things, try force-refreshing?

The URL of that page might give a hint perhaps?
https://it-tools.domain.com/auth/callback?code=[some complex value]&state=[some complex value]

So I am thinking that perhaps the callback is not what it should be?

Any help or insight would be appreciated!

UPDATE: I went to IOS and Firefox and pasted the domain of the service there
so without the /auth/callback?code=[some complex value]&state=[some complex value] part:
https://it-tools.domain.com/
And while it went to Authentik once more, the service the shows as it should be!

Originally created by @reddwarf666 on GitHub (Apr 2, 2025). My setup I think you know but I'll list it so others are aware: - Docker - Cloudflare DNS - Godoxy 10.0 - Authentik 2025.2.2 This all seems to work fine on whatever browser I use on my desktop. Except when I use Firefox and/or Chrome on IOS, then I get a message "missing state cookie". The procedure is to: 1. Navigate to a self hosted service - `cyberchef.domain.com` or `it-tools.domain.com` for example 2. Authentik shows and I need to login 3. I return to a blank page with only the message "missing state cookie" Out of all the components I use I have. no clue which one is responsible for this, if any at all tbh. This could be related to the IOS platform or the browsers themselves. And the odd thing is, if I try Safari on IOS it works as expected, I get to the service(s) just fine So I realize this might entirely unrelated to Godoxy but I am at my wits end on how to solve this. My only reasoning to make a issue here with Godoxy is that it is one of the components serving the service to the browser(s) so this is my hail mary and see if you or someone else has a clue on what might be wrong and how to fix this. Looking at the logs of Godoxy is see no record of this request it seems Looking at the logs of Authentik I see no obvious issues I transferred the browser page in IOS to my desktop (handover) and I see the it-tools page but with this message: ``` 404 Not Found Sorry, this page does not seem to exist Maybe the cache is doing tricky things, try force-refreshing? ``` The URL of that page might give a hint perhaps? https://it-tools.domain.com/auth/callback?code=[some complex value]&state=[some complex value] So I am thinking that perhaps the callback is not what it should be? Any help or insight would be appreciated! UPDATE: I went to IOS and Firefox and pasted the domain of the service there so without the `/auth/callback?code=[some complex value]&state=[some complex value]` part: https://it-tools.domain.com/ And while it went to Authentik once more, the service the shows as it should be!
adam added the bug label 2025-12-29 14:23:29 +01:00
adam closed this issue 2025-12-29 14:23:29 +01:00
adam commented 2025-12-29 14:23:29 +01:00
Author
Owner
Copy Link

@yusing commented on GitHub (Apr 3, 2025):

Maybe privacy settings of your browser is causing the issue. Will investigate in it asap.

@yusing commented on GitHub (Apr 3, 2025): Maybe privacy settings of your browser is causing the issue. Will investigate in it asap.
adam commented 2025-12-29 14:23:30 +01:00
Author
Owner
Copy Link

@reddwarf666 commented on GitHub (Apr 21, 2025):

Hi There!

Any news on this issue? I could not resolve this on my end and have no clue what is happening.

Cheers

@reddwarf666 commented on GitHub (Apr 21, 2025): Hi There! Any news on this issue? I could not resolve this on my end and have no clue what is happening. Cheers
adam commented 2025-12-29 14:23:30 +01:00
Author
Owner
Copy Link

@yusing commented on GitHub (Apr 21, 2025):

Sorry for the late reply. I'll check it now, will reply back within today.

@yusing commented on GitHub (Apr 21, 2025): Sorry for the late reply. I'll check it now, will reply back within today.
adam commented 2025-12-29 14:23:31 +01:00
Author
Owner
Copy Link

@reddwarf666 commented on GitHub (Apr 21, 2025):

Awesome! Thanks!

@reddwarf666 commented on GitHub (Apr 21, 2025): Awesome! Thanks!
adam commented 2025-12-29 14:23:31 +01:00
Author
Owner
Copy Link

@yusing commented on GitHub (Apr 21, 2025):

Please pull again and see if the problem persist. I've just tesed with Chrome on iOS and it works like charm.

@yusing commented on GitHub (Apr 21, 2025): Please pull again and see if the problem persist. I've just tesed with Chrome on iOS and it works like charm.
adam commented 2025-12-29 14:23:31 +01:00
Author
Owner
Copy Link

@reddwarf666 commented on GitHub (Apr 21, 2025):

I updated my container just now, version 0.10.1

I can get it to work with Safari and Chrome, thanks!
Firefox is still a bit of an issue, missing state cookie still show for some reason.
I did have to go all out on wiping all Chrome settings before I got rid of that message.

Is there anything you would like to have from me for information to analyze this?
I can imagine you might find this an edge case, just the one browser on a mobile, so if you need to invest your time in other cases or development then I completely understand. All in all I can use this on Safari and Chrome after all.

Just give me a ping on Discord if you do want some more info from me and I'll try to give you any info you might need.

@reddwarf666 commented on GitHub (Apr 21, 2025): I updated my container just now, version 0.10.1 I can get it to work with Safari and Chrome, thanks! Firefox is still a bit of an issue, `missing state cookie` still show for some reason. I did have to go all out on wiping all Chrome settings before I got rid of that message. Is there anything you would like to have from me for information to analyze this? I can imagine you might find this an edge case, just the one browser on a mobile, so if you need to invest your time in other cases or development then I completely understand. All in all I can use this on Safari and Chrome after all. Just give me a ping on Discord if you do want some more info from me and I'll try to give you any info you might need.
adam commented 2025-12-29 14:23:31 +01:00
Author
Owner
Copy Link

@yusing commented on GitHub (Apr 21, 2025):

No problem. I'll download Firefox now to test it out. Will let you know if there is any info that can help.

@yusing commented on GitHub (Apr 21, 2025): No problem. I'll download Firefox now to test it out. Will let you know if there is any info that can help.
adam commented 2025-12-29 14:23:31 +01:00
Author
Owner
Copy Link

@yusing commented on GitHub (Apr 24, 2025):

Closing this issue now. For anyone interested:

The issue is caused when typing the url without https. Since Firefox on iOS doesn't do auto https, the state cookie can't be read due to the secure flag while having a non-secure connection.

@yusing commented on GitHub (Apr 24, 2025): Closing this issue now. For anyone interested: The issue is caused when typing the url without https. Since Firefox on iOS doesn't do auto https, the state cookie can't be read due to the `secure` flag while having a non-secure connection.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
enhancement
pull-request
Mirrored from GitHub Pull Request
 wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/godoxy-yusing#53
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?