Set-Cookie Header is Split when using OIDC together with AWS Lambda

[c-classen]

Describe the bug

I think I have a similar problem to #25580. I am trying to use the quarkus-oidc extension together with an AWS Lambda deployment using quarkus-amazon-lambda-http. When I remove the quarkus-amazon-lambda-http dependency from the project, everything works fine. However when it is included in the dependencies so the Mock Lambda Event Server is used in dev mode, the q_auth-Cookie breaks (in two parts).

This is part of the headers that Quarkus responds with:

< set-cookie: q_auth=6b6a7588-802f-49ea-a276-64e6bac263d1|/auth/authenticateAndRedirect?url=http%3A%2F%2Flocalhost%3A3000%2F; Max-Age=1800; Expires=Wed
< set-cookie: 22 Mar 2023 13:44:01 GMT; Path=/; HTTPOnly

As you can see, the comma that is used within the expiration value now is interpreted by the AWS Lambda Mock Server (and probably also the real one) as the separating character between two header values.

Expected behavior

No response

Actual behavior

No response

How to Reproduce?

Steps to reproduce:

1. Go to https://code.quarkus.io, select "AWS Lambda HTTP" as well as "OpenID Connect" and download and extract the ZIP
2. Change maven.compiler.release to 11 (probably not necessary, I just did not have the required java version installed)
3. Add the following to the application.properties:

quarkus.oidc.application-type=web_app
# Enforce OIDC usage for all paths
quarkus.http.auth.permission.authenticated.paths=/*
quarkus.http.auth.permission.authenticated.policy=authenticated

4. Run ./mvnw quarkus:dev
5. Execute curl localhost:8080 -v

Now you can see two set-cookie headers, of which at least the second one looks broken

Output of uname -a or ver

No response

Output of java -version

No response

GraalVM version (if different from Java)

No response

Quarkus version or git rev

No response

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

No response

(edited to add missing reproduction step)

[quarkus-bot]

/cc @matejvasek (amazon-lambda), @patriot1burke (amazon-lambda), @pedroigor (oidc), @sberyozkin (oidc)

[sberyozkin]

@c-classen Hi, this is probably related to the cookie size limitation, can you try configuring quarkus-oidc to use a token split strategy, https://quarkus.io/guides/security-openid-connect-web-authentication#token-state-manager, and see if it helps ?

[c-classen]

Thank you for the response, but the documentation you linked to talks about a 4KB limit for cookies, and the q_auth cookie is far away from that. Just to be clear: I am not talking about the q_session cookie containing the complete OIDC identity token. The set-cookie header for the q_auth cookie will only be something like this if AWS Lambda support is disabled:

q_auth=374bd7c5-c78a-4cf9-85b2-defab10b508e|/auth/authenticateAndRedirect?url=http%3A%2F%2Flocalhost%3A3000%2F; Max-Age=1800; Expires=Wed, 22 Mar 2023 15:16:55 GMT; Path=/; HTTPOnly

This is far less than 1KB. Also, I find it extremely suspicious that the header value is split at the only comma in this string, which really points to issue #25580.

I still added quarkus.oidc.token-state-manager.split-tokens=true to the application properties, but it did not change anything. However I found that I missed a step to reproduce the issue and added that.

[sberyozkin]

Thanks @c-classen I did not realize this is was a state cookie, so it is Expires property.

@patriot1burke This can probably be fixed with some super simple regex ? (I'm hiding myself :-) )

[gsmet]

IIRC, the lambda stuff has some code that splits multi-valued cookies and I'm pretty sure the problem is related to that.

[c-classen]

Ok, so the problem seems to be how the HTTP response is transformed to a JSON object that AWS Lambda understands.

The relevant part of the code is here. The problem is that AWS Lambda will always interpret commas in a header value as separators between different header values. However, in the case of cookies, there is a workaround by specifying the cookie property in the APIGatewayV2HTTPResponse object.

So in the loop that iterates over the header names, one could check whether the header name is Set-Cookie and then put the array of values in the cookie property.

[sberyozkin]

@c-classen Hi,

So in the loop that iterates over the header names, one could check whether the header name is Set-Cookie and then put the array of values in the cookie property.

That sounds reasonable, if you'd like, please open a PR, also CC @patriot1burke