Install and configure the OpenID Connect plugin

Oct 13, 2025 by wbrum.org 29 views

Introduction

The OpenID Connect plugin in APISIX is a crucial component for enabling authentication and authorization in your API gateway. However, a recent issue has been reported where the session cookie set by the plugin is always treated as a "session cookie," regardless of the lifetime option specified. In this article, we will delve into the current behavior, expected behavior, and steps to reproduce this issue.

Current Behavior

The session cookie set by the OpenID Connect plugin is always set as a "session cookie." This means that the lifetime option specified in the plugin configuration has no effect on the cookie's expiration time. As a result, the cookie is always treated as a session cookie, which can lead to unexpected behavior and security vulnerabilities.

Expected Behavior

Given that the resty session library used by the OpenID Connect plugin does not support setting the lifetime of the cookie, it is recommended to remove the lifetime option from the plugin configuration. This would ensure that the cookie is treated as a session cookie, which is the expected behavior for this type of cookie.

Error Logs

Unfortunately, there are no error logs available for this issue, as it is related to the behavior of the OpenID Connect plugin rather than an error condition.

Steps to Reproduce

To reproduce this issue, follow these steps:

Install and configure the OpenID Connect plugin: Install the OpenID Connect plugin in your APISIX instance and configure it to use a valid OpenID Connect provider.
Log in to the plugin: Log in to the OpenID Connect plugin using a valid username and password.
Inspect the Set-Cookie header: Inspect the Set-Cookie header returned by the request to .apisix/redirect at the end of the flow. You should see that the session cookie is always set as a "session cookie," regardless of the lifetime option specified.

Environment

To troubleshoot this issue, it is essential to provide information about your environment. Please provide the following details:

APISIX version: Run apisix version to get the version of your APISIX instance.
Operating system: Run uname -a to get the operating system and kernel version.
OpenResty / Nginx version: Run openresty -V or nginx -V to get the version of your OpenResty or Nginx instance.
etcd version: Run curl http://127.0.0.1:9090/v1/server_info to get the version of your etcd instance, if relevant.
APISIX Dashboard version: Run apisix dashboard version to get the version of your APISIX Dashboard instance, if relevant.
Plugin runner version: Run plugin-runner version to get the version of your plugin runner instance, if relevant.
LuaRocks version: Run luarocks --version to get the version of your LuaRocks instance, if relevant.

Conclusion

In conclusion, the OpenID Connect plugin in APISIX has a bug where the session cookie lifetime option has no effect. This issue is caused by the fact that the resty session library used by the plugin does not support setting the lifetime of the cookie. To resolve this issue, it is recommended to remove the lifetime option from the plugin configuration. We hope that this article has provided valuable information and insights into this issue, and we look forward to hearing from you if you have any further questions or concerns.

Troubleshooting Tips

Here are some troubleshooting tips to help you resolve this issue:

Check the plugin configuration: Ensure that the lifetime option is correctly configured in the plugin configuration.
Verify the cookie settings: Verify that the cookie settings are correctly set in the plugin configuration.
Check the resty session library: Check the resty session library documentation to see if it supports setting the lifetime of the cookie.
Update the plugin: Update the OpenID Connect plugin to the latest version to see if the issue is resolved.

Related Issues

Here are some related issues that you may encounter:

Cookie expiration time: The cookie expiration time is not set correctly, leading to unexpected behavior.
Session cookie lifetime: The session cookie lifetime is not set correctly, leading to unexpected behavior.
OpenID Connect plugin configuration: The OpenID Connect plugin configuration is not correctly set, leading to unexpected behavior.

FAQs

Here are some frequently asked questions related to this issue:

Q: What is the cause of this issue? A: The cause of this issue is that the resty session library used by the OpenID Connect plugin does not support setting the lifetime of the cookie.
Q: How can I resolve this issue? A: To resolve this issue, it is recommended to remove the lifetime option from the plugin configuration.
Q: What are the consequences of this issue? A: The consequences of this issue are that the cookie is always treated as a session cookie, which can lead to unexpected behavior and security vulnerabilities.
Q&A: OpenID Connect Plugin - Session Cookie Lifetime Has No Effect ====================================================================

Q: What is the OpenID Connect plugin in APISIX?

A: The OpenID Connect plugin in APISIX is a crucial component for enabling authentication and authorization in your API gateway. It allows you to integrate with OpenID Connect providers to authenticate and authorize users.

Q: What is the issue with the session cookie lifetime in the OpenID Connect plugin?

A: The issue is that the session cookie lifetime option has no effect, and the cookie is always treated as a session cookie, regardless of the lifetime option specified.

Q: Why does the resty session library not support setting the lifetime of the cookie?

A: The resty session library used by the OpenID Connect plugin does not support setting the lifetime of the cookie because it is not a feature that is currently implemented.

Q: How can I resolve this issue?

A: To resolve this issue, it is recommended to remove the lifetime option from the plugin configuration. This will ensure that the cookie is treated as a session cookie, which is the expected behavior for this type of cookie.

Q: What are the consequences of this issue?

A: The consequences of this issue are that the cookie is always treated as a session cookie, which can lead to unexpected behavior and security vulnerabilities.

Q: How can I troubleshoot this issue?

A: To troubleshoot this issue, you can follow these steps:

Check the plugin configuration: Ensure that the lifetime option is correctly configured in the plugin configuration.
Verify the cookie settings: Verify that the cookie settings are correctly set in the plugin configuration.
Check the resty session library: Check the resty session library documentation to see if it supports setting the lifetime of the cookie.
Update the plugin: Update the OpenID Connect plugin to the latest version to see if the issue is resolved.

Q: What are some related issues that I may encounter?

A: Some related issues that you may encounter include:

Cookie expiration time: The cookie expiration time is not set correctly, leading to unexpected behavior.
Session cookie lifetime: The session cookie lifetime is not set correctly, leading to unexpected behavior.
OpenID Connect plugin configuration: The OpenID Connect plugin configuration is not correctly set, leading to unexpected behavior.

Q: How can I prevent this issue from occurring in the future?

A: To prevent this issue from occurring in the future, you can:

Regularly update the OpenID Connect plugin: Regularly update the OpenID Connect plugin to the latest version to ensure that you have the latest features and bug fixes.
Verify the plugin configuration: Verify that the plugin configuration is correctly set to ensure that the cookie is treated as a session cookie.
Check the resty session library documentation: Check the resty session library documentation to see if it supports setting the lifetime of the cookie.

Q: Where can I find more information about this issue?

A: You can find more information about this issue in the APISIX documentation and in the OpenID Connect plugin documentation. Additionally, you can search for related issues and solutions on the APISIX community forum and on other online resources.