{"action":"created","issue":{"url":"https://api.github.com/repos/panva/node-oidc-provider/issues/403","repository_url":"https://api.github.com/repos/panva/node-oidc-provider","labels_url":"https://api.github.com/repos/panva/node-oidc-provider/issues/403/labels{/name}","comments_url":"https://api.github.com/repos/panva/node-oidc-provider/issues/403/comments","events_url":"https://api.github.com/repos/panva/node-oidc-provider/issues/403/events","html_url":"https://github.com/panva/node-oidc-provider/issues/403","id":383013671,"node_id":"MDU6SXNzdWUzODMwMTM2NzE=","number":403,"title":"Duplicate Cookies with different Path's","user":{"login":"marcelalburg","id":4396769,"node_id":"MDQ6VXNlcjQzOTY3Njk=","avatar_url":"https://avatars0.githubusercontent.com/u/4396769?v=4","gravatar_id":"","url":"https://api.github.com/users/marcelalburg","html_url":"https://github.com/marcelalburg","followers_url":"https://api.github.com/users/marcelalburg/followers","following_url":"https://api.github.com/users/marcelalburg/following{/other_user}","gists_url":"https://api.github.com/users/marcelalburg/gists{/gist_id}","starred_url":"https://api.github.com/users/marcelalburg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcelalburg/subscriptions","organizations_url":"https://api.github.com/users/marcelalburg/orgs","repos_url":"https://api.github.com/users/marcelalburg/repos","events_url":"https://api.github.com/users/marcelalburg/events{/privacy}","received_events_url":"https://api.github.com/users/marcelalburg/received_events","type":"User","site_admin":false},"labels":[{"id":294286318,"node_id":"MDU6TGFiZWwyOTQyODYzMTg=","url":"https://api.github.com/repos/panva/node-oidc-provider/labels/question","name":"question","color":"cc317c","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-11-21T08:51:50Z","updated_at":"2018-11-21T09:06:29Z","closed_at":"2018-11-21T09:00:53Z","author_association":"NONE","body":"Hello,\r\n\r\ni created a default serverless oidc-provider and when i make this curl i got cookies with a wrong path - /auth instead of /inteaction\r\n\r\n```\r\ncurl -D - \"localhost:3000/auth?client_id=test_client&response_type=code&scope=openid&redirect_url=https://example.com/xxx\"\r\nHTTP/1.1 302 Found\r\npragma: no-cache\r\ncache-control: no-cache, no-store\r\nlocation: /interaction/394e95c8-c590-448b-a0ea-61f8450ebf70\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 129\r\ndate: Wed, 21 Nov 2018 08:40:07 GMT\r\nconnection: close\r\nset-cookie: _grant=394e95c8-c590-448b-a0ea-61f8450ebf70; path=/auth/394e95c8-c590-448b-a0ea-61f8450ebf70; expires=Wed, 21 Nov 2018 08:50:07 GMT; httponly\r\nset-cookie: _grant.sig=aeTTZdFCIxOt08zETYact6B8q78; path=/auth/394e95c8-c590-448b-a0ea-61f8450ebf70; expires=Wed, 21 Nov 2018 08:50:07 GMT; httponly\r\n\r\nRedirecting to <a href=\"/interaction/394e95c8-c590-448b-a0ea-61f8450ebf70\">/interaction/394e95c8-c590-448b-a0ea-61f8450ebf70\r\n```\r\n\r\nI debugged and enabled logging and see that someone is adding the same cookie with a different path:\r\n\r\n`Serverless: [302] {\"statusCode\":302,\"body\":\"Redirecting to <a href=\\\"/interaction/394e95c8-c590-448b-a0ea-61f8450ebf70\\\">/interaction/394e95c8-c590-448b-a0ea-61f8450ebf70</a>.\",\"headers\":{\"pragma\":\"no-cache\",\"cache-control\":\"no-cache, no-store\",\"location\":\"/interaction/394e95c8-c590-448b-a0ea-61f8450ebf70\",\"content-type\":\"text/html; charset=utf-8\",\"content-length\":\"129\",\"date\":\"Wed, 21 Nov 2018 08:40:07 GMT\",\"connection\":\"close\",\"Set-cookie\":\"_grant=394e95c8-c590-448b-a0ea-61f8450ebf70; path=/interaction/394e95c8-c590-448b-a0ea-61f8450ebf70; expires=Wed, 21 Nov 2018 08:50:07 GMT; httponly\",\"sEt-cookie\":\"_grant.sig=aeTTZdFCIxOt08zETYact6B8q78; path=/interaction/394e95c8-c590-448b-a0ea-61f8450ebf70; expires=Wed, 21 Nov 2018 08:50:07 GMT; httponly\",\"SEt-cookie\":\"_grant=394e95c8-c590-448b-a0ea-61f8450ebf70; path=/auth/394e95c8-c590-448b-a0ea-61f8450ebf70; expires=Wed, 21 Nov 2018 08:50:07 GMT; httponly\",\"seT-cookie\":\"_grant.sig=aeTTZdFCIxOt08zETYact6B8q78; path=/auth/394e95c8-c590-448b-a0ea-61f8450ebf70; expires=Wed, 21 Nov 2018 08:50:07 GMT; httponly\"},\"isBase64Encoded\":false}\r\n`\r\n\r\nI know it's not exact only your product, but maybe you've an idea. Inside the oidc-provider i just see that ./actions/authorization/interactions.js is setting the correct cookies.\r\n\r\nThanks\r\nMarcel"},"comment":{"url":"https://api.github.com/repos/panva/node-oidc-provider/issues/comments/440588698","html_url":"https://github.com/panva/node-oidc-provider/issues/403#issuecomment-440588698","issue_url":"https://api.github.com/repos/panva/node-oidc-provider/issues/403","id":440588698,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MDU4ODY5OA==","user":{"login":"panva","id":241506,"node_id":"MDQ6VXNlcjI0MTUwNg==","avatar_url":"https://avatars3.githubusercontent.com/u/241506?v=4","gravatar_id":"","url":"https://api.github.com/users/panva","html_url":"https://github.com/panva","followers_url":"https://api.github.com/users/panva/followers","following_url":"https://api.github.com/users/panva/following{/other_user}","gists_url":"https://api.github.com/users/panva/gists{/gist_id}","starred_url":"https://api.github.com/users/panva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/panva/subscriptions","organizations_url":"https://api.github.com/users/panva/orgs","repos_url":"https://api.github.com/users/panva/repos","events_url":"https://api.github.com/users/panva/events{/privacy}","received_events_url":"https://api.github.com/users/panva/received_events","type":"User","site_admin":false},"created_at":"2018-11-21T09:06:29Z","updated_at":"2018-11-21T09:06:29Z","author_association":"OWNER","body":"ad serverless, are you using lambda to host? care share the adapter (i'm guessing dynamo) with the rest here?"}}
{"actor":{"display_login":"panva"}}