Why am I getting a CSRF 403 from OAuth2 Proxy when running on GKE but not locally?

Question

I have a simple setup that is using OAuth2 Proxy to handle authentication. It works fine locally using minikube but when I try to use GKE when the oauth callback happens I get a 403 status and the the following message...

Login Failed: Unable to find a valid CSRF token. Please try again.

The offending url is http://ourdomain.co/oauth2/callback?code=J_6ao0AxSBRn4bwr&state=r_aFqM9wsSpPvyKyyzE_nagGnpNKUp1pLyZafOEO0go%3A%2Fip

What should be configured differently to avoid the CSRF error?

score 3 · Accepted Answer · answered Mar 04 '22 at 17:15

3

In my case it was because I needed to set the cookie to secure = false. Apparently I could still have secure true no problem with http and an IP but once I uploaded with a domain it failed.

answered Mar 04 '22 at 17:15

Jackie

21,969
32
147
289

2

Are you refering to cookie-secure in oauth2 proxy env configuration? I have done that still i am getting error – Sagar Shetty Aug 12 '22 at 06:41

Why am I getting a CSRF 403 from OAuth2 Proxy when running on GKE but not locally?

1 Answers1