Request Header Or Cookie Too Large

[RubenLWF]

I am trying out plugin for the first time, and I am running into an error where I am not able to access my downstream applications because the header is too large. I have checked out the mininalHeaders setting, but the problem is that the client cookie is sent to the backend service. Since this cookie is very large, my application is not able to handle this.

Anything I can try to help get this resolved?

[fbrnc]

I can confirm this. While mininalHeaders only strips out the X-Auth-Request-* headers it's the three large Cookies that will bloat up the request for the backend service. Since those aren't interesting for the backend service it would be nice to have them stripped as well.

Currently I'm using a second plugin (rewrite headers) to remove those cookies after the oidc middleware:

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: strip-oidc-cookies
spec:
  plugin:
    rewriteHeaders:
      rewrites:
        request:
          # Remove any "_oidc_*" cookie pairs
          - header: Cookie
            regex: '(^|;\s*)_oidc_[^=]*=[^;]*'
            replacement: ''

[gboor]

I just ran into this as well and I would like to propose a different approach that is also utilized by oauth2-proxy;

It would be nice to have an option to store the token not in cookies, but in Redis if a Redis backend is enabled. Then issue a ticket that is stored as a small cookie. On request, the full token can be fetched from Redis to define whatever headers need to be passed to the backend and the client only needs a ticket cookie. This would also seriously reduce the overhead of each request to traefik itself.

[lukaszraczylo]

Hi everyone, sorry for a bit of delay - could you try the latest version ( released today ) with following setting:

stripAuthCookies: true

It should prevent the traefikoidc plugin from forwarding the oidc cookies which are technically useless to it to the backend :)

[fbrnc]

Just tried the new version with stripAuthCookies: true and it works perfectly fine. Thank you so much for the fast update!

(And yes, storing the token in Redis and only referencing it in a much smaller cookie - like oauth2-proxy does - would also be nice...)

[lukaszraczylo]

@fbrnc that'll be the next enhancement - for now I just wanted to sort out the burning issue, then think about the secure redis side implementation as we are still talking about signing and validation to avoid possible interception :)