From time to time clients get Internal Server Error

[MaxBazarov]

Here is my auth_openidc.conf:

OIDCResponseType "id_token token"
OIDCScope openid
OIDCResponseMode form_post
OIDCProviderMetadataURL https://login.microsoftonline.com//v2.0/.well-known/openid-configuration
OIDCProviderJwksUri https://login.microsoftonline.com//discovery/v2.0/keys
OIDCClientID
OIDCClientSecret
OIDCRedirectURI https://uxteam.int.zone/oidc-redirect
OIDCCryptoPassphrase
OIDCStateMaxNumberOfCookies 7 true
#OIDCStateTimeout 360000000
OIDCSessionInactivityTimeout 31536000
OIDCSessionMaxDuration 0
OIDCCacheType file
OIDCSessionType server-cache:persistent
Redirect permanent https://uxteam.int.zone/secure https://uxteam.int.zone

AuthType openid-connect
Require valid-user
Require ip 157.43.177.63 47.11.145.55
<Location /_tools>
AuthType None
Require all granted

How can I resolve it ? Thanks!

[zandbelt]

see this: https://github.com/zmartzone/mod_auth_openidc/wiki/Cookies#state-cookies-are-piling-up

[MaxBazarov]

But I don't use OIDCSessionType client-cookie !

[zandbelt]

that does not have anything to do with it, please read the page: it is about state cookies

[MaxBazarov]

Thanks.

[MaxBazarov]

After last update my config looks like this:

OIDCStateMaxNumberOfCookies 2 true
OIDCStateTimeout 180
OIDCUnAuthAction 401 "%{HTTP_ACCEPT} =~ m#image/png#"
OIDCUnAuthAction 401 "%{HTTP_ACCEPT} =~ m#image/jpg#"
OIDCUnAuthAction 401 "%{HTTP_ACCEPT} =~ m#text/css#"
OIDCUnAuthAction 401 "%{HTTP_ACCEPT} =~ m#text/javascript#"

We don't start any Ajax code on page loading, but anyway, I added "X-Requested-With" to all other Ajax calls.

It worked fine on my tests. But today my user complains again about Bad Request.
On the attached screenshot we see many states cookies. It makes me maid.

[zandbelt]

FWIW: in the server side debug log you'll see what URLs those state cookies are served from so you can analyse it better than in the browser.

You'll need to use a single OIDCUnAuthAction primitive with a combined expression as in your current setup only the last one will prevail and actually override the default X-Requested-With detection algorithm...

Moreover, if all your XML HTTP request are really using X-Requested-With by now then you can just get rid of all OIDCUnAuthAction primitives as they only override the default setting that would work fine on its own.

[MaxBazarov]

Ok, thanks for OIDCUnAuthAction information. I will apply changes.
But the question is still the same. Why user does get soo many state cookies?