{"record":{"id":"4638eaf17316fee8","repo":"siyuan-note/siyuan","slug":"save-oidc-login-session-failed","errorCode":null,"errorMessage":"Save OIDC login session failed","messagePattern":"Save OIDC login session failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/model/oidc.go","lineNumber":1008,"sourceCode":"\t\t\t\tret = append(ret, values[0])\n\t\t\t}\n\t\t}\n\t\treturn ret\n\tdefault:\n\t\treturn nil\n\t}\n}\n\nfunc authenticateOIDCSession(c *gin.Context, rememberMe bool) error {\n\tsession := util.GetSession(c)\n\tworkspaceSession := util.GetWorkspaceSession(session)\n\tworkspaceSession.AccessAuthCode = \"\"\n\tapplyAuthenticatedSession(c, workspaceSession, rememberMe)\n\tutil.WrongAuthCount = 0\n\tutil.AuthThrottleReset(c.ClientIP())\n\tif err := session.Save(c); err != nil {\n\t\tlogging.LogErrorf(\"save OIDC session failed: %s\", err)\n\t\treturn errors.New(\"Save OIDC login session failed\")\n\t}\n\tutil.BroadcastByType(\"auth\", \"loginAuth\", 0, \"\", nil)\n\treturn nil\n}\n\nfunc secureRandomToken(size int) (string, error) {\n\tbuffer := make([]byte, size)\n\tif _, err := rand.Read(buffer); err != nil {\n\t\treturn \"\", err\n\t}\n\treturn base64.RawURLEncoding.EncodeToString(buffer), nil\n}\n\nfunc safeOIDCRedirectTarget(target string) string {\n\tparsed, err := url.Parse(target)\n\tif err != nil || parsed.IsAbs() || strings.HasPrefix(target, \"//\") || !strings.HasPrefix(target, \"/\") ||\n\t\tstrings.Contains(target, \"\\\\\") {\n\t\treturn \"/\"","sourceCodeStart":990,"sourceCodeEnd":1026,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/model/oidc.go#L990-L1026","documentation":"OIDC authentication succeeded but session.Save(c) returned an error when persisting the authenticated session. The wrapped error is logged via logging.LogErrorf (\"save OIDC session failed: ...\"). Because the session could not be saved, the user is not treated as logged in.","triggerScenarios":"The session store cannot encode or write the session - cookie overflow (session payload too large for the cookie/store limit), store backend write failure, or serialization failure.","commonSituations":"Session cookie exceeds browser/proxy size limits because of large session data; session store directory not writable; serialization of an unexpected type inside the session.","solutions":["Read the kernel log for the wrapped error: \"save OIDC session failed: <reason>\".","If cookie-overflow, reduce the session payload or switch session storage configuration.","Confirm write permissions and temp space for the session store.","Retry login once the underlying persistence issue is cleared."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Surface the wrapped save error so the operator can diagnose the session store.\nif err := session.Save(c); err != nil {\n    logging.LogErrorf(\"save OIDC session failed: %s\", err)\n    return fmt.Errorf(\"could not persist login session: %w\", err)\n}","preventionTips":["Keep the session payload small to avoid cookie-size limits.","Ensure the session store directory/temp space is writable by the kernel process.","Monitor kernel logs for 'save OIDC session failed' and address the wrapped cause."],"tags":["oidc","session","persistence","authentication"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}