Internal Server Error happens with release 2.4.15.5 and timed out sessions

[HolgerHees]

After updating to version 2.4.15.3 and 2.4.15.5 I got a 500 after 1 hour of inactivity until I delete my cookies, followed by a relogin. First Time I saw it was directly after updating to 2.4.15.3, but still it is reproducible with latest version 2.4.15.5.

I opened my browser after 12 hours and everything was fine. I had to login again. Then I keeped my browser window open for an hour, without any interaction and got this error after a page reload. The one hour is related to my OIDCSessionInactivityTimeout setting.

This are the apache error logs

[2024-03-14 08:46:42.519687] [auth_openidc:error] oidc_util_json_string_print: oidc_util_check_json_error: response contained an "error" entry with value: ""invalid_request""
[2024-03-14 08:46:42.519751] [auth_openidc:error] oidc_util_json_string_print: oidc_util_check_json_error: response contained an "error_description" entry with value: ""Invalid Credentials""
[2024-03-14 08:46:42.519771] [auth_openidc:warn] oidc_refresh_token_grant: refresh token routine called but no refresh_token found in the session
[2024-03-14 08:46:42.519812] [auth_openidc:error] oidc_userinfo_retrieve_claims: refreshing access token failed, claims will not be retrieved/refreshed from the userinfo endpoint

and this is my configuration

OIDCProviderMetadataURL https://accounts.google.com/.well-known/openid-configuration
OIDCClientID <MYID>.apps.googleusercontent.com
OIDCClientSecret <MYSECRET>

OIDCCryptoPassphrase <MYCRYPTOPASSPHRASE>

OIDCScope "openid email profile"
OIDCRemoteUserClaim email

OIDCPassClaimsAs environment

OIDCCookie session_openidc
OIDCCookieDomain <MYDOMAIN>

OIDCDefaultURL https://<MYDOMAIN>/_auth/invalid/
OIDCRedirectURI https://<MYDOMAIN>/redirect_uri

OIDCSessionInactivityTimeout 3600
OIDCSessionMaxDuration 86400

OIDCStateMaxNumberOfCookies 10 true

OIDCCookieSameSite Off

[zandbelt]

could you please send the full server debug log to [email protected]?

[HolgerHees]

I start collecting debug logs now. I will send it to you when the error happens again.

[zandbelt]

please confirm bc447a8

[HolgerHees]

I'm running on master branch now and will keep an eye on it. If it goes well until tomorrow I'll give you feedback again.

And thanks again!

[HolgerHees]

confirmed and everything works as expected! Updated to version 2.4.15.6 right now.

[zandbelt]

thanks for confirming; on a related note: you have set explicitly set OIDCCookieSameSite Off, why is that? FWIW: there appears to to be an issue with newer Chrome versions that was addressed in 2.4.15.6

[HolgerHees]

you are right, it was a leftover where I experimented a bit with subdomains and shared cookies.

btw. and maybe its interesting for you, I'm using your project for my private smartserver

https://github.com/HolgerHees/smartserver