hydra
hydra copied to clipboard
ory
Not able to perform simultaneous auth flows with different clients
Preflight checklist
- [X] I could not find a solution in the existing issues, docs, nor discussions.
- [X] I agree to follow this project's Code of Conduct.
- [X] I have read and am following this repository's Contribution Guidelines.
- [ ] This issue affects my Ory Cloud project.
- [X] I have joined the Ory Community Slack.
- [X] I am signed up to the Ory Security Patch Newsletter.
Describe the bug
After reading this comment, I understand that Hydra didn't support this 4 years ago (Wow, that's a long time!). However, I feel that when multiple distinct clients are performing the auth flow, hydra should be able to support each of them individually.
Reproducing the bug
- Open 2 different apps, with 2 different clients
- Initiate the login flow in different tabs of the same browser
- Error: The CSRF value from the token does not match the CSRF value from the data store
Version
v1.10.7
On which operating system are you observing this issue?
Linux
In which environment are you deploying?
Kubernetes with Helm
Additional Context
Here's the use case: We have multiple apps loaded in an iFrame and they all perform the authentication flow simultaneously. This is according to the SMART on FHIR specification for healthcare applications. We need to load all the iFrames simultaneously to optimize the speed of loading. Also, there are instances when multiple apps with different client ids might be opened on different tabs. We don't have control over most of these applications since they are developed by 3rd party developers.
How about setting the cookie name based on the client_id? Or something similar?
More discussions here: https://stackoverflow.com/questions/65493296/authorization-code-flow-concurrent-requests-from-multiple-tabs
For example, if instead of
using a constant cookieAuthenticationCSRFName in these places:
https://github.com/ory/hydra/blob/b17b47431672b2c046a17869c18c8ff81a454170/consent/strategy_default.go#L284
https://github.com/ory/hydra/blob/b17b47431672b2c046a17869c18c8ff81a454170/consent/strategy_default.go#L360
if we can somehow make it specific for each client, cookieAuthenticationCSRFName + clientId for instance, do you see it causing any problems?
Any updates on this? Will this resolve only for the different clients running simultaneous, but not e.g. two login sessions for the same client opened in two tabs?
