hashicorp/nomad · warning

too many auth requests

Error message

too many auth requests

What it means

ErrTooManyRequests is returned when the RequestCache already holds MaxRequests (1000) entries and a new OIDC auth-url request cannot be stored. The bounded LRU cache exists so pending OIDC auth requests cannot exhaust server memory.

Source

Thrown at lib/auth/oidc/request.go:21

package oidc

import (
	"errors"
	"fmt"
	"sync"
	"time"

	"github.com/hashicorp/cap/oidc"
	"github.com/hashicorp/golang-lru/v2/expirable"
)

var (
	ErrNonceReuse = errors.New("nonce reuse detected")
	// ErrTooManyRequests is returned if the request cache is full.
	// Realistically, we expect this only to happen if the auth-url
	// API endpoint is being DOS'd.
	ErrTooManyRequests = errors.New("too many auth requests")
)

// MaxRequests is how many requests are allowed to be stored at a time.
// It needs to be large enough for legitimate user traffic, but small enough
// to prevent a DOS from eating up server memory.
const MaxRequests = 1000

// NewRequestCache creates a cache for OIDC requests.
// The JWT expiration time in the cap library is 5 minutes,
// so timeout should be around that long.
func NewRequestCache(timeout time.Duration) *RequestCache {
	return &RequestCache{
		c: expirable.NewLRU[string, *oidc.Req](MaxRequests, nil, timeout),
	}
}

type RequestCache struct {
	c    *expirable.LRU[string, *oidc.Req]

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Retry the auth-url request after a short delay; entries expire from the expirable LRU cache, freeing capacity.
2. Mitigate the traffic source — rate-limit or block abusive clients hammering the auth-url endpoint.
3. Investigate why callbacks are not consuming entries (stuck sessions), and verify cache TTL/MaxRequests sizing suits your legitimate traffic.

err := rc.store(req)
if errors.Is(err, oidc.ErrTooManyRequests) {
    time.Sleep(backoff) // then retry the auth-url request
    return retryAuthURL()
}

When it happens

Trigger: RequestCache.storeLocked is invoked while rc.c.Len() >= MaxRequests (1000) — i.e. more than 1000 in-flight auth-url requests with nonces not yet consumed by callbacks.

Common situations: DOS or burst traffic against the ACL auth-url endpoint (as the source comment notes); callbacks never arriving so stale entries occupy the cache until TTL expiry; load tests generating thousands of parallel logins.

Related errors

• no auth method config or client assertion
• certificate has expired or is not yet valid
• x5t assertion headers use SHA-1, which is forbidden in FIPS-
• nonce reuse detected
• invalid or missing issuer parameter in callback

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/3127f7f47e169692. Report an issue: GitHub.