title: JupyterHub "400 : Bad Request OAuth state missing from cookies" generic authentication
body: <p>I am trying to deploy a jupyterhub service behind a NGINX reverse proxy on OpenStack and using the generic authentication class to authenticate users from an external OIDC provider. After redirecting from the authentication server I get a &quot;400: Bad Request  OAuth state missing from cookies&quot; error message. Here are my jupyterhub_config.py contents:</p>
  <pre><code>c = get_config()
  import os
  # use Generic OAuthenticator for local users
  from oauthenticator.generic import GenericOAuthenticator
  
  c.Application.log_level = 'DEBUG'
  
  c.JupyterHub.authenticator_class = GenericOAuthenticator
  c.GenericOAuthenticator.client_id =  os.environ['IAM_CLIENT_ID']
  c.GenericOAuthenticator.client_secret = os.environ['IAM_CLIENT_SECRET']
  c.GenericOAuthenticator.token_url = os.environ['OAUTH2_TOKEN_URL']
  c.GenericOAuthenticator.userdata_url = 'https://iam-escape.cloud.cnaf.infn.it/userinfo'
  c.GenericOAuthenticator.authorize_url = os.environ['OAUTH2_AUTHORIZE_URL']
  #c.OAuthenticator.tls_verify = False
  c.GenericOAuthenticator.userdata_method = 'GET'
  c.GenericOAuthenticator.userdata_params = {'state': 'state'}
  c.GenericOAuthenticator.username_key = &quot;preferred_username&quot;
  c.GenericOAuthenticator.login_service = 'ESCAPE IAM'
  c.GenericOAuthenticator.scope = ['openid', 'profile']
  c.GenericOAuthenticator.oauth_callback_url = os.environ['OAUTH_CALLBACK_URL']
  #************** Port and IP settings
  # the hostname/ip that should be used to connect to the hub
  # this is usually the hub container's name
  #*************Spawner settings
  # pick a docker image. This should have the same version of jupyterhub
  # in it as our Hub.
  # launch with docker
  c.JupyterHub.spawner_class = 'jhub.SwarmSpawner'
  c.JupyterHub.hub_ip = '0.0.0.0'
  c.JupyterHub.bind_url = 'http://jhub:8000'
  #Introduce the name of the jupyterhub service is given in docker-compose to the jupyterhub
  c.SwarmSpawner.jupyterhub_service_name = 'jhub'
  #Introduce the defined network given in the compose file to the jupyterhub
  c.SwarmSpawner.networks = [&quot;jhub_net&quot;]
  
  # Available docker images the user can spawn
  c.SwarmSpawner.images = [
      {'image': 'jupyter/scipy-notebook:latest',
       'name': 'scipy notebook',
       'placement': {'constraints': ['node.hostname==r3b-notebook']}},
      }
  ]
  
  c.SwarmSpawner.spawn_timeout = 60
  # Before the user can select which image to spawn,user_options has to be enabled
  c.SwarmSpawner.use_user_options = True
  c.JupyterHub.shutdown_on_logout = True
  # debug-logging for testing
  import logging
  c.JupyterHub.log_level = logging.DEBUG
  
  </code></pre>
  <p><strong>and my nginx config file:</strong></p>
  <pre><code>user www-data;
  worker_processes auto;
  pid /run/nginx.pid;
  include /etc/nginx/modules-enabled/*.conf;
  
  events {
      worker_connections 1024;
  }
  
  http {
  
      map $http_upgrade $connection_upgrade {
          default upgrade;
          ''      close;
      }
  
           server {
              listen 80 ssl;
              server_name HUB.DOMAIN.TLD;
  #           ssl on;
              ssl_certificate /etc/nginx/ssl/myssl.crt;
              ssl_certificate_key /etc/nginx/ssl/myssl.key;
  
              ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
              ssl_prefer_server_ciphers on;
              ssl_session_cache shared:SSL:50m;
              ssl_session_timeout 1d;
              ssl_stapling on;
              ssl_stapling_verify on;
              add_header Strict-Transport-Security max-age=15768000;
              resolver_timeout 5s;
  
              # Expose logs to &quot;docker logs&quot;.
              # See https://github.com/nginxinc/docker-nginx/blob/master/Dockerfile#L12-L14
              access_log /var/log/nginx/access.log;
              error_log /var/log/nginx/error.log;
  
              location / {
              proxy_pass       http://jhub:8000;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header Host $host:$server_port;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  #
              proxy_http_version    1.1;
              proxy_set_header      Upgrade $http_upgrade;
              proxy_set_header      Connection $connection_upgrade;
              proxy_set_header X-Scheme $scheme;
              proxy_buffering off;
              }
          }
  
  }
  
  </code></pre>
  <p><strong>The error message in the browser is as follow:</strong></p>
  <pre><code>HTTP/1.1 400 Bad Request
  Server: nginx/1.19.6
  Date: Thu, 16 Sep 2021 12:54:51 GMT
  Content-Type: text/html
  Content-Length: 4365
  Connection: keep-alive
  x-jupyterhub-version: 1.2.1
  access-control-allow-headers: accept, content-type, authorization
  content-security-policy: frame-ancestors 'self'; report-uri /hub/security/csp-report
  set-cookie: oauthenticator-state=&quot;&quot;; expires=Wed, 16 Sep 2020 12:54:51 GMT; Path=/
  </code></pre>
  <p><strong>and a bunch of warnings:</strong></p>
  <pre><code>Cookie “oauthenticator-state” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite oauth_callback
  Cookie “oauthenticator-state” has been rejected because it is already expired. oauth_callback
  Strict-Transport-Security: The connection to the site is untrustworthy, so the specified header was ignored.
  style.min.css
  This page uses the non standard property “zoom”. Consider using calc() in the relevant property values, or using “transform” along with “transform-origin: 0 0”. oauth_callback
  Strict-Transport-Security: The connection to the site is untrustworthy, so the specified header was ignored.
  bootstrap.min.js
  Strict-Transport-Security: The connection to the site is untrustworthy, so the specified header was ignored.
  require.js
  Strict-Transport-Security: The connection to the site is untrustworthy, so the specified header was ignored.
  jquery.min.js
  Strict-Transport-Security: The connection to the site is untrustworthy, so the specified header was ignored.
  favicon.ico
  </code></pre>
  <p>I am using Jupyterhub version 1.2.1 and nginx 1.19.6 and all the services are running in the Docker container in Swarm mode. However, I have tried the simplest scenario with only a jupyterhub without nginx proxy and with docker spawner and the problem remains as it is. I will appreciate any idea of how to tackle this issue to find a solution.</p>