envoyproxy/envoy

Stateful Session cookies incompatible between Envoy Processes.

Open

#44,111 建立於 2026年3月25日

在 GitHub 查看
 (1 留言) (0 反應) (1 負責人)C++ (27,997 star) (5,373 fork)batch import
bughelp wanted

描述

Title: Stateful Session cookies incompatible between Envoy Processes.

Description: When using Envoy as an Edge Proxy with multiple instances (an NLB in front) AND using the StatefulSession with cookies doesn't work properly.

The cookie is encoded with the expiry time BUT it uses the monotonic clock:

https://github.com/envoyproxy/envoy/blob/21b70d126c0a5c16d844658ee2db68f94deb7548/source/extensions/http/stateful_session/cookie/cookie.cc#L21-L22

When HTTP requests are routed to different Envoy processes, they will have different values for their monotonic clock and the cookie can inadvertently expire sooner then its should, which will cause a new backend to get selected.

I believe the appropriate fix is for time_source_.systemTime() to be used so that two envoy processes can validate each other cookies.

cc @cpakulski

貢獻者指南

技術棧
cpp
領域
backendinfrastructure
議題類型
bug
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
3
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
1-3 hours
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
blocked
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
clear
前置要求
C++ knowledgeEnvoy internalsMonotonic vs system clock
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
40
研究方向
Examine the file source/extensions/http/stateful session/cookie/cookie.cc around line 21-22 where the monotonic clock is used. Consider replacing time source .monotonicTime() with time source .systemTime(). Verify that the change doesn't break existing tests. Check if any other parts of the codebase rely on the monotonic behavior for cookie expiry.