breakfix: cookie/token is invalidated before it expires

[vnxme]

Describe the issue

I have Caddy (a Docker container) handling multiple subdomains and use caddy-security to protect a number of them. E.g. when I want to view test.domain.com, I get redirected to auth.domain.com, I put my credentials there, and finally I get redirected back to test.domain.com with a valid access_token cookie set.

After some time has passed, e.g. 15 minutes or more, I can still view test.domain.com and other subdomains, unless the cookie/token gets expired (I use 24 hours period as both cookie and token lifetime). However, if I navigate to auth.domain.com/portal, or just auth.domain.com, my cookie is invalidated, and I get redirected to auth.domain.com/login.

What’s also important, it doesn’t happen every time. And I can’t track what it may be caused by. But when it does happen, it’s quite annoying to type credentials every time it asks, even though I have already logged in a few minutes/hours before.

Configuration

Paste full Caddyfile below:

{
	order authenticate before respond
	order authorize before basicauth
	security {
	    local identity store users {
	        realm local
	        path /data/caddy/users.json
	    }
	    authorization policy authpolicy {
	        allow roles authp/admin authp/user
	        crypto key verify [secret_value]
	        set auth url https://auth.domain.com/
	        validate source address
	    }
	    authentication portal authportal {
	        cookie domain domain.com
	        cookie lifetime 86400
	        crypto default token lifetime 86400
	        crypto key sign-verify [secret_value]
	        enable identity store users
	        enable source ip tracking
	    }
}
domain.com, *.domain.com {
	import [tls_encoding_headers_etc]
	@auth host auth.domain.com
	handle @auth {
	        authenticate with authportal
	}
	handle {
		authorize with authpolicy
		import [reverse_proxy_etc]
	}
}

Version Information

Provide output of caddy list-modules --versions | grep -E "(auth|security)" below:

caddy v2.7.6
security v1.1.23

Expected behavior

I don't expect a cookie/token to be invalidated until it expires or unless the user logs out.

Additional context

Can't say exactly how many minutes should pass before caddy-security demonstrates such behaviour. It seems to occur both if I restart Caddy within this time frame or just leave it running.

[GerardPolloRebozado]

I have same issue