Files
TimeTracker/tests
Dries Peeters e15f0e2154 fix(oidc): avoid login loop by storing id_token server-side instead of in session cookie
When the IdP issues a large id_token (e.g. with groups claim), storing it in Flask's cookie session can exceed ~4KB and cause the browser to drop the cookie, leading to redirect loops between /auth/oidc/callback and /login.

Store id_token in Redis/in-memory cache; keep only a small reference key (oidc_id_token_key) in the session cookie. On logout, resolve id_token from cache for RP-initiated logout; support legacy session for backwards compatibility. Add regression test for oversized id_token and update OIDC logout tests.

Fixes #486

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-02 17:24:45 +01:00
..