Cookie SAME_SITE = strict doens't work with external SSO #11635

New Issue

2025-11-02T09:43:06-06:00

GiteaMirror commented

2025-11-02 09:43:06 -06:00

Originally created by @wxiaoguang on GitHub (Sep 12, 2023).

For example (#27023): the OAuth2, users will only see a 500 page with error log "UserSignIn: could not find a matching session for this request". Many users have reported similar issues.

The reason is that the callback request doesn't send the original cookie (session id), so the session data is lost in the callback.

Originally created by @wxiaoguang on GitHub (Sep 12, 2023). For example (#27023): the OAuth2, users will only see a 500 page with error log "UserSignIn: could not find a matching session for this request". Many users have reported similar issues. The reason is that the callback request doesn't send the original cookie (session id), so the session data is lost in the callback.

GiteaMirror added the type/bug label 2025-11-02 09:43:06 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#11635

Cookie SAME_SITE = strict doens't work with external SSO #11635

Cookie `SAME_SITE = strict` doens't work with external SSO #11635