Social login: "No resumable session could be found in the HTTP Header." #2108

saulofilho · 2022-01-04T18:23:07Z

saulofilho
Jan 4, 2022

Hi, guys.

I'm trying to implement a Social Login with Google but I'm receiving this error:
"code": 400,"status":"Bad Request","reason":"No resumable session could be found in the HTTP Header.","debug":"key ory_kratos_oidc_auth_code_session does not exist in cookie: map[]..."

What ory_kratos_oidc_auth_code_session stands for?

Thank you.

Answered by aeneasr

Jan 4, 2022

Hello, this can sometimes happen when something goes wrong with cookies or the browser has a weird plugin installed. Just try the flow again, it should then work! If not, delete the cookies for the domain and try again

View full answer

aeneasr · 2022-01-04T19:57:25Z

aeneasr
Jan 4, 2022
Maintainer

Hello, this can sometimes happen when something goes wrong with cookies or the browser has a weird plugin installed. Just try the flow again, it should then work! If not, delete the cookies for the domain and try again

1 reply

saulofilho Jan 4, 2022
Author

Nice, thanks. I really tried this before. But I gonna try it again. If has any update, I'll post here.

saulofilho · 2022-01-06T20:23:37Z

saulofilho
Jan 6, 2022
Author

Hi. It's me again.

I'm still stuck in this error.

Here it goes what I'm doing:

1.
Inits the browser's flow to get the flow id:
GET http://local.angeplus.com.br/iam-svc/public/self-service/registration/browser

Cookie was setted:
Name: csrf_token_6e30977bbcc76f0a13b9753cab1b4760c9b51745d668cc47faf7ef7beab35bce
Value: Vydg+77NYElkBa9GrHiJNrjLq3L0I3zrms35IdS87bI=

2.
Than, I'm pass the flow:
GET http://local.angeplus.com.br/iam-svc/public/self-service/registration/flows?id=86c5581b-7e23-446b-afa6-0e6821d23fac

Responds with 200 where I can get the csrf_token value:

{
	"id": "86c5581b-7e23-446b-afa6-0e6821d23fac",
	"type": "browser",
	"expires_at": "2022-01-06T20:15:17.58475Z",
	"issued_at": "2022-01-06T20:05:17.58475Z",
	"request_url": "http://local.angeplus.com.br/self-service/registration/browser",
	"ui": {
		"action": "http://local.angeplus.com.br/iam-svc/public/self-service/registration?flow=86c5581b-7e23-446b-afa6-0e6821d23fac",
		"method": "POST",
		"nodes": [
			{
				"type": "input",
				"group": "default",
				"attributes": {
					"name": "csrf_token",
					"type": "hidden",
					"value": "5eikUYcFsVkV+gYEXfOEYs13z/nUi3h7LHNAAGtge6eyz8SqOcjREHH/qULxiw1UdbxkiyCoBJC2vrkhv9yWFQ==",

3.
After that, I'm trying to complete the flow:
POST http://local.angeplus.com.br/iam-svc/public/self-service/registration?flow=86c5581b-7e23-446b-afa6-0e6821d23fac

Form URL Encoded:
method=oidc&provider=google&csrf_token=5eikUYcFsVkV%2BgYEXfOEYs13z%2FnUi3h7LHNAAGtge6eyz8SqOcjREHH%2FqULxiw1UdbxkiyCoBJC2vrkhv9yWFQ%3D%3D

Cookie was setted:
Name: ory_kratos_continuity
Value: MTY0MTQ5OTc0OHxEdi1CQkFFQ180SUFBUkFCRUFBQVhfLUNBQUVHYzNSeWFXNW5EQ01BSVc5eWVWOXJjbUYwYjNOZmIybGtZMTloZFhSb1gyTnZaR1ZmYzJWemMybHZiZ1p6ZEhKcGJtY01KZ0FrTTJFek5UZ3laRGN0Wm1JNE1TMDBNamd4TFRnd1pHTXRNamd3T1Rrell6VXdaRFpofMvmcjUyEASYMKdVYK2DYAurKzQUqKDVEDowFFEfKFcy

Receives:
Location:

https://accounts.google.com/o/oauth2/v2/auth?claims=%7B%22id_token%22%3A%7B%22email%22%3A%7B%22essential%22%3Atrue%7D%2C%22email_verified%22%3A%7B%22essential%22%3Atrue%7D%7D%7D&client_id=410142226801-hfn6eon0ucgk1kiddc36ljrmuhsngsr6.apps.googleusercontent.com&redirect_uri=http%3A%2F%2Flocal.angeplus.com.br%2Fiam-svc%2Fpublic%2Fself-service%2Fmethods%2Foidc%2Fcallback%2Fgoogle&response_type=code&scope=email+profile+openid&state=c8acef4d-989b-4cf4-a259-5630f57fb279

Set-Cookie:

ory_kratos_continuity=MTY0MTQ5OTc0OHxEdi1CQkFFQ180SUFBUkFCRUFBQVhfLUNBQUVHYzNSeWFXNW5EQ01BSVc5eWVWOXJjbUYwYjNOZmIybGtZMTloZFhSb1gyTnZaR1ZmYzJWemMybHZiZ1p6ZEhKcGJtY01KZ0FrTTJFek5UZ3laRGN0Wm1JNE1TMDBNamd4TFRnd1pHTXRNamd3T1Rrell6VXdaRFpofMvmcjUyEASYMKdVYK2DYAurKzQUqKDVEDowFFEfKFcy; Path=/;

When I click on location I got the error:
404 This page could not be found.

Debugging:
GET http://local.angeplus.com.br/iam-svc/public/self-service/errors?id=bf995dd5-6ec7-4cf0-bb2a-6c283d7e5742

{
	"id": "bf995dd5-6ec7-4cf0-bb2a-6c283d7e5742",
	"error": {
		"code": 400,
		"debug": "key ory_kratos_oidc_auth_code_session does not exist in cookie: map[]\ngithub.com/ory/kratos/x.SessionGetString\n\t/home/ory/x/cookie.go:34\ngithub.com/ory/kratos/continuity.(*ManagerCookie).sid\n\t/home/ory/continuity/manager_cookie.go:99\ngithub.com/ory/kratos/continuity.(*ManagerCookie).container\n\t/home/ory/continuity/manager_cookie.go:109\ngithub.com/ory/kratos/continuity.(*ManagerCookie).Continue\n\t/home/ory/continuity/manager_cookie.go:64\ngithub.com/ory/kratos/selfservice/strategy/oidc.(*Strategy).validateCallback\n\t/home/ory/selfservice/strategy/oidc/strategy.go:215\ngithub.com/ory/kratos/selfservice/strategy/oidc.(*Strategy).handleCallback\n\t/home/ory/selfservice/strategy/oidc/strategy.go:259\ngithub.com/ory/kratos/selfservice/strategy.disabledWriter\n\t/home/ory/selfservice/strategy/handler.go:25\ngithub.com/ory/kratos/selfservice/strategy.IsDisabled.func1\n\t/home/ory/selfservice/strategy/handler.go:30\ngithub.com/ory/kratos/x.NoCacheHandler.func1\n\t/home/ory/x/nocache.go:18\ngithub.com/julienschmidt/httprouter.(*Router).ServeHTTP\n\t/go/pkg/mod/github.com/julienschmidt/httprouter@v1.3.0/router.go:387\ngithub.com/ory/nosurf.(*CSRFHandler).handleSuccess\n\t/go/pkg/mod/github.com/ory/nosurf@v1.2.5/handler.go:201\ngithub.com/ory/nosurf.(*CSRFHandler).ServeHTTP\n\t/go/pkg/mod/github.com/ory/nosurf@v1.2.5/handler.go:158\ngithub.com/urfave/negroni.Wrap.func1\n\t/go/pkg/mod/github.com/urfave/negroni@v1.0.0/negroni.go:46\ngithub.com/urfave/negroni.HandlerFunc.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/negroni@v1.0.0/negroni.go:29\ngithub.com/urfave/negroni.middleware.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/negroni@v1.0.0/negroni.go:38\ngithub.com/ory/kratos/x.glob..func1\n\t/home/ory/x/clean_url.go:12\ngithub.com/urfave/negroni.HandlerFunc.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/negroni@v1.0.0/negroni.go:29\ngithub.com/urfave/negroni.middleware.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/negroni@v1.0.0/negroni.go:38\ngithub.com/urfave/negroni.(*Negroni).ServeHTTP\n\t/go/pkg/mod/github.com/urfave/negroni@v1.0.0/negroni.go:96\ngithub.com/rs/cors.(*Cors).Handler.func1\n\t/go/pkg/mod/github.com/rs/cors@v1.6.0/cors.go:207\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2069\nnet/http.serverHandler.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2887\nnet/http.(*conn).serve\n\t/usr/local/go/src/net/http/server.go:1952\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1371",
		"reason": "No resumable session could be found in the HTTP Header.",
		"status": "Bad Request",
		"message": "session is not resumable"
	},
	"created_at": "2022-01-06T20:11:18.292048Z",
	"updated_at": "2022-01-06T20:11:18.292048Z"
}

Where's my mistake?

Save me!

26 replies

seunggs Jan 27, 2022

@aeneasr I'm getting this exact issue with Github now and I'm running everything in my browser.

@saulofilho Did you ever resolve this?

This is what I'm doing in my local env (http://localhost:3002 - Kratos is installed via helm in my EKS Kubernetes cluster and exposed via emissary-ingress mapping at kratos.sidetrek.com):

GET https://kratos.sidetrek.com/self-service/registration/browser -> this gives me back the flow info
POST https://kratos.sidetrek.com/self-service/registration?flow=b28f7b8d-5161-48be-92a8-385ad1b24bae -> this gives me 422 browser_location_change_required error with err.response.data.redirect_browser_to, which I use to redirect
That's when I get the 400 session is not resumable error with No resumable session could be found in the HTTP Header..

I have the multiple subdomain setup via helm values:

config: {
  serve: {
    public: {
      base_url: `https://kratos.sidetrek.com`,
      domain_aliases: [
        {
          match_domain: `localhost:3002`,
          base_path: '/',
          scheme: 'http',
        },
        {
          match_domain: `sidetrek.com`,
          base_path: '/',
          scheme: 'https',
        },
        {
          match_domain: `staging.sidetrek.com`,
          base_path: '/',
          scheme: 'https',
        },
      ],
    }
  }
}

I also noticed that even though in the response from the POST call above I see the set-cookie response header with ory_kratos_continuity value set, I don't see anything saved in my cookies (if I look at it with Chrome browser's Cookies for localhost:3002 domain). I am running Kratos in development mode.

What am I doing wrong?

saulofilho Jan 27, 2022
Author

Hi, @seunggs.

I didn't get.
Therefore, my team had to take a step back to rebuild the engineering, because we have a flow which couldn't work with these aspects, for example an entity with multiple concerns, the microservices instances, the Oauthkeeper and other stuff.

saulofilho Jan 27, 2022
Author

We are currently working hard to produce a patch or a workaround to achieve this. When we got it, I'll post here.

seunggs Jan 28, 2022

I see - thanks!

aeneasr Jan 30, 2022
Maintainer

You need to make sure that everything is executed in the same browser, you can not do part on a server and another part on the browser. Also make sure that cookies are properly being set (in AJAX this is done with credentials-include) :)

bruno-nascimento · 2022-06-04T20:04:56Z

bruno-nascimento
Jun 4, 2022

I had the same issue.
in kratos.yml (selfservice/methods/oidc/providers/github)i was using 127.0.0.1 and in github oauth application Authorization callback URL I was using localhost. I change it to 127.0.0.1 in github and it worked.

1 reply

vinckr Jun 7, 2022
Maintainer

Thanks for sharing your fix! Its important to keep the "localhost/127.0.0.1" consistent (in many cases such as OIDC)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Social login: "No resumable session could be found in the HTTP Header." #2108

{{title}}

Replies: 3 comments 28 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Social login: "No resumable session could be found in the HTTP Header." #2108

saulofilho Jan 4, 2022

Replies: 3 comments · 28 replies

aeneasr Jan 4, 2022 Maintainer

saulofilho Jan 4, 2022 Author

saulofilho Jan 6, 2022 Author

seunggs Jan 27, 2022

saulofilho Jan 27, 2022 Author

saulofilho Jan 27, 2022 Author

seunggs Jan 28, 2022

aeneasr Jan 30, 2022 Maintainer

bruno-nascimento Jun 4, 2022

vinckr Jun 7, 2022 Maintainer

saulofilho
Jan 4, 2022

Replies: 3 comments 28 replies

aeneasr
Jan 4, 2022
Maintainer

saulofilho Jan 4, 2022
Author

saulofilho
Jan 6, 2022
Author

saulofilho Jan 27, 2022
Author

saulofilho Jan 27, 2022
Author

aeneasr Jan 30, 2022
Maintainer

bruno-nascimento
Jun 4, 2022

vinckr Jun 7, 2022
Maintainer