DongHyeonkaandClaude Opus 5
bcb563a04e
oauth2-proxy carries the authorization request in a signed cookie, so the callback can land on a different replica and still succeed, which is the opposite of the BFF failure in B-0. Sharing is therefore just sharing one Secret. Rotating it is all-or-nothing: --cookie-secret is singular, so there is no second key to read old tickets with, and the log shows both the validation failure and Error removing session, leaving the Redis session orphaned because the key cannot be derived from a ticket that will not decode. Getting there required two diagnoses: the callback 502 came from the full session riding in Set-Cookie past nginx's buffer, and every earlier attempt to read nginx config returned nothing because sudo on the host asks for a password while the guests do not. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
4 lines
147 B
YAML
4 lines
147 B
YAML
- generic [active] [ref=f42e1]:
|
|
- heading "502 Bad Gateway" [level=1] [ref=f42e3]
|
|
- separator [ref=f42e4]
|
|
- generic [ref=f42e5]: nginx/1.30.4 |