Can't log in, HTTP 401 error, "authorization request has expired", possible cookies issue #451

New issue

Open

opened 2026-05-29 16:02:12 -05:00 by amarevite · 2 comments

amarevite commented

2026-05-29 16:02:12 -05:00

(Migrated from github.com)

Describe the bug:

I really wish I could give a clear description but it's so unclear to me what is going on under the hood. If I try to log in with Vivaldi (Flatpak), I usually get a login loop similar to #120. Sometimes I don't. There is no obvious reason it does or doesn't work. Sometimes trying in a fresh incognito tab works, sometimes it doesn't — sometimes minutes apart it will go from working to not working. Today I started getting a brand new variation I haven't seen before where for some reason my browser requests /oidc/auth/ZoKiDnVA93biCsqFI3U3S0nUll6tEg3acRx4atH2CVn and receives the response {"error":"invalid_request","error_description":"authorization request has expired"}. An incognito tab does not have this behavior and just login loops similar to issue #120. I switched to :edge and set ENABLE_DEBUG: true and found no clear help in the logs, but I will include them. #337 might also be related since I only use a passkey and do not use a password for this account.

To Reproduce:

Attempt to log in.

Expected behavior:

Database Driver:

Screenshots:

Additional context:

Note that for the following logs, I have replaced my real public ip address with 1.2.3.4, and my real domain with example.com.
Logs for non-incognito tab (I have cleared all cookies and site data that I could find, to no avail):

{"timestamp":1780086952191,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/api/user/me"},"response":{"statusCode":401}}}
{"timestamp":1780086952337,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/api/public/config"},"response":{"statusCode":200}}}
{"timestamp":1780086952355,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/api/interaction/exists"},"user":{"id":"c0b02e6c-b9ff-4e9d-9b0a-1445584c8e09","username":"paris","source":"interaction","amr":["webauthn","webauthn_v"]},"response":{"statusCode":200}}}
{"timestamp":1780086952397,"level":"error","message":"oidc-provider authorization error","details":{"response":{"statusCode":400},"request":{"ip":"1.2.3.4","method":"GET","path":"/oidc/auth/ZoKiDnVA93biCsqFI3U3S0nUll6tEg3acRx4atH2CVn"}},"errors":[{"name":"SessionNotFound","message":"invalid_request"}]}

Logs for incognito tab:

{"timestamp":1780087778620,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"POST","path":"/api/interaction/passkey/start"},"response":{"statusCode":200}}}
{"timestamp":1780087779726,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"POST","path":"/api/interaction/passkey/end"},"login":{"user_id":"c0b02e6c-b9ff-4e9d-9b0a-1445584c8e09","amr":["webauthn","webauthn_v"]},"response":{"statusCode":200}}}
{"timestamp":1780087779792,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/oidc/auth/FNmxxUl17MSmFwjO-8-46ZLx09Sfa-rUHJ2J-y2t8MQ"},"response":{"statusCode":303,"location":"/api/interaction"}}}
{"timestamp":1780087779946,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/api/interaction"},"interaction":{"prompt":"login","reasons":["login_prompt","no_session"],"client_id":"auth_internal_client","redirect_uri":"https://void.example.com/api/cb"},"response":{"statusCode":302,"location":"https://void.example.com/login"}}}
{"timestamp":1780087780212,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/api/user/me"},"response":{"statusCode":401}}}
{"timestamp":1780087780300,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/api/public/config"},"response":{"statusCode":200}}}
{"timestamp":1780087780305,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/api/interaction/exists"},"response":{"statusCode":200}}}

### Describe the bug: I really wish I could give a clear description but it's so unclear to me what is going on under the hood. If I try to log in with Vivaldi (Flatpak), I usually get a login loop similar to #120. Sometimes I don't. There is no obvious reason it does or doesn't work. Sometimes trying in a fresh incognito tab works, sometimes it doesn't — sometimes minutes apart it will go from working to not working. Today I started getting a brand new variation I haven't seen before where for some reason my browser requests `/oidc/auth/ZoKiDnVA93biCsqFI3U3S0nUll6tEg3acRx4atH2CVn` and receives the response `{"error":"invalid_request","error_description":"authorization request has expired"}`. An incognito tab does not have this behavior and just login loops similar to issue #120. I switched to `:edge` and set `ENABLE_DEBUG: true` and found no clear help in the logs, but I will include them. #337 might also be related since I only use a passkey and do not use a password for this account. ### To Reproduce: Attempt to log in. ### Expected behavior: Login succeeds. ### Database Driver:  ### Screenshots:  ### Additional context: Note that for the following logs, I have replaced my real public ip address with 1.2.3.4, and my real domain with example.com. Logs for non-incognito tab (I have cleared all cookies and site data that I could find, to no avail): ``` {"timestamp":1780086952191,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/api/user/me"},"response":{"statusCode":401}}} {"timestamp":1780086952337,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/api/public/config"},"response":{"statusCode":200}}} {"timestamp":1780086952355,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/api/interaction/exists"},"user":{"id":"c0b02e6c-b9ff-4e9d-9b0a-1445584c8e09","username":"paris","source":"interaction","amr":["webauthn","webauthn_v"]},"response":{"statusCode":200}}} {"timestamp":1780086952397,"level":"error","message":"oidc-provider authorization error","details":{"response":{"statusCode":400},"request":{"ip":"1.2.3.4","method":"GET","path":"/oidc/auth/ZoKiDnVA93biCsqFI3U3S0nUll6tEg3acRx4atH2CVn"}},"errors":[{"name":"SessionNotFound","message":"invalid_request"}]} ``` Logs for incognito tab: ``` {"timestamp":1780087778620,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"POST","path":"/api/interaction/passkey/start"},"response":{"statusCode":200}}} {"timestamp":1780087779726,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"POST","path":"/api/interaction/passkey/end"},"login":{"user_id":"c0b02e6c-b9ff-4e9d-9b0a-1445584c8e09","amr":["webauthn","webauthn_v"]},"response":{"statusCode":200}}} {"timestamp":1780087779792,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/oidc/auth/FNmxxUl17MSmFwjO-8-46ZLx09Sfa-rUHJ2J-y2t8MQ"},"response":{"statusCode":303,"location":"/api/interaction"}}} {"timestamp":1780087779946,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/api/interaction"},"interaction":{"prompt":"login","reasons":["login_prompt","no_session"],"client_id":"auth_internal_client","redirect_uri":"https://void.example.com/api/cb"},"response":{"statusCode":302,"location":"https://void.example.com/login"}}} {"timestamp":1780087780212,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/api/user/me"},"response":{"statusCode":401}}} {"timestamp":1780087780300,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/api/public/config"},"response":{"statusCode":200}}} {"timestamp":1780087780305,"level":"debug","message":"API Response Sent","details":{"request":{"ip":"1.2.3.4","method":"GET","path":"/api/interaction/exists"},"response":{"statusCode":200}}} ```

amarevite commented

2026-05-30 00:59:35 -05:00

(Migrated from github.com)

Eight hours later and when I tried again everything works fine. No rhyme or reason that I can figure out, but it working hours later has me continuing to think it's related to cookies or some other local data expiring and the frontend not handling it correctly. I'm switching back to :latest for now, but let me know if there is further testing you would like me to do. I'm going to leave this issue open since it's a recurring problem, not a one-off, and it's not clear to me what actually changed.

Eight hours later and when I tried again everything works fine. No rhyme or reason that I can figure out, but it working hours later has me continuing to think it's related to cookies or some other local data expiring and the frontend not handling it correctly. I'm switching back to `:latest` for now, but let me know if there is further testing you would like me to do. I'm going to leave this issue open since it's a recurring problem, not a one-off, and it's not clear to me what actually changed.

notquitenothing commented

2026-05-30 08:02:16 -05:00

(Migrated from github.com)

I'm glad it's working for you now, weird error. From the logs you provided it looks like something wrong with the session, maybe the cookie could't be set? Feel free to continue this issue if the error pops up again