Perimeter: parallel sign-ins fail with invalid code_verifier
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 83/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- terraform
- Domain
- authentication, infrastructure
Research direction
Start by reading the perimeter module in infra/terraform/modules/access/perimeter and check how its oauth2-proxy instances are configured. Add the per-request CSRF cookie and expiry flags described in the issue, then verify that both portal and service sign-ins succeed in separate tabs of a fresh private window without an error page.
Written by the indexing model from the issue text.
Description
Found in the fresh-cluster qualification (maintainer, 2026-10-19). Two sign-ins started at the same time, for example two tabs or the portal and a service opened together in a fresh window. The first callback failed:
oauthproxy.go:950 Error redeeming code during OAuth2 callback: token exchange failed: oauth2: "invalid_grant" "Invalid code_verifier."
The user got the perimeter's 500 page. The second sign-in succeeded 26 s later, and a reload fixed it.
Cause: oauth2-proxy keeps one CSRF/PKCE cookie per browser, so the second flow overwrites the first one's verifier.
Fix: add --cookie-csrf-per-request=true (and --cookie-csrf-expire, for example 5m) to the perimeter instances in infra/terraform/modules/access/perimeter. oauth2-proxy v7.15.5 supports both flags.
Acceptance: opening the portal and a service in two tabs of a fresh private window signs in both without an error page.
🤖 Generated with Claude Code
- Dominant language
- Python
- Stars
- 26
- Forks
- 6
- Avg merge
- 12h 26m
- Merged PRs (30d)
- 162
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from OpenLakeForge/openlakeforge
-
bug good first issue help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
OpenLakeForge/openlakeforge#498 ·
Maintainers usually reply within 1 day
-
bug good first issue help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
OpenLakeForge/openlakeforge#497 ·
Maintainers usually reply within 1 day
-
feat(cli): export `olf query` output directly to a filePossibly taken @dbdefault claimed this today. Openenhancement good first issue help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
OpenLakeForge/openlakeforge#494 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
good first issue help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
OpenLakeForge/openlakeforge#488 ·
Maintainers usually reply within 1 day
-
good first issue help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
OpenLakeForge/openlakeforge#487 ·
Maintainers usually reply within 1 day
All issues in OpenLakeForge/openlakeforge
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
MISP/misp-workbench#496 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
fossasia/visdom-dev#69 ·
Maintainers usually reply within 3 days
-
[Bug] Parameters named like a property break to_xcal()Possibly taken @atharvasalunke1267 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
collective/icalendar#2018 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day