Authentik OIDC: "Cannot complete user auth: securecookie: the value is too long: 4140"

[nervous-inhuman]

This issue was previously disscussed in #148, however I'm moving the discussion here so it can be found more easily, and that there won't be two conversations about two separate issues happening in one thread at once.

When trying to sign-in through Authentik, the user receives the following error:

There is also a discussion happening in the upstream project that opengist uses for OAuth in Go: markbates/goth#463

[nervous-inhuman]

Tried looking into this further this evening, seems like there's no easy(?) way to override MaxLength for CookieStore and doing so would break stuff, see: gorilla/sessions#109 (comment)

Seems like the suggested approach is to use a different store such as FilesystemStore

[nervous-inhuman]

Seems like naively replacing CookieStore with FilesystemStore works, and I can sign-up/sign-in via Authentik SSO now.

I have no idea how much/if it breaks anything, but so far it everything seems to be working.

diff --git a/internal/web/server.go b/internal/web/server.go
index 994e6c2..3a5538f 100644
--- a/internal/web/server.go
+++ b/internal/web/server.go
@@ -32,7 +32,7 @@ import (

 var (
        dev   bool
-       store *sessions.CookieStore
+       store *sessions.FilesystemStore
        re    = regexp.MustCompile("[^a-z0-9]+")
        fm    = template.FuncMap{
                "split":     strings.Split,
@@ -151,7 +151,8 @@ type Server struct {

 func NewServer(isDev bool) *Server {
        dev = isDev
-       store = sessions.NewCookieStore([]byte("opengist"))
+       store = sessions.NewFilesystemStore("", []byte("opengist"))
+       store.MaxLength(10 * 1024)
        gothic.Store = store

        e := echo.New()

[thomiceli]

i thought about FilesystemStore also, but I have to make sure it's properly working

[thomiceli]

Also considering a way to choose Redis for the session system but it might add a small complexity to maintain the infrastructure as a whole

[nervous-inhuman]

If it's optional, then having an another option to use it should be left to the user. Personally, I'd prefer the FilesystemStore as default if possible.