oauth2-proxy/oauth2-proxy · error

error decoding ticket to clear session: %v

Error message

error decoding ticket to clear session: %v

What it means

Manager.Clear decodes the ticket from the request cookie before clearing session state server-side. If decoding fails with any error other than http.ErrNoCookie (e.g. malformed ticket string), Clear returns this wrapped error because it cannot derive the store key to delete.

Source

Thrown at pkg/sessions/persistence/manager.go:86

	)
}

// Clear clears any saved session information for a given ticket cookie.
// Then it clears all session data for that ticket in the Store.
func (m *Manager) Clear(rw http.ResponseWriter, req *http.Request) error {
	tckt, err := decodeTicketFromRequest(req, m.Options)
	if err != nil {
		// Always clear the cookie, even when we can't load a cookie from
		// the request
		tckt = &ticket{
			options: m.Options,
		}
		tckt.clearCookie(rw, req)
		// Don't raise an error if we didn't have a Cookie
		if err == http.ErrNoCookie {
			return nil
		}
		return fmt.Errorf("error decoding ticket to clear session: %v", err)
	}

	tckt.clearCookie(rw, req)
	return tckt.clearSession(func(key string) error {
		return m.Store.Clear(req.Context(), key)
	})
}

// VerifyConnection validates the underlying store is ready and connected
func (m *Manager) VerifyConnection(ctx context.Context) error {
	return m.Store.VerifyConnection(ctx)
}

View on GitHub (pinned to 33c2eb92de)

Solutions

1. Have the user clear their cookies; the server session becomes orphaned but the client recovers.
2. Treat malformed tickets like missing ones: check for http.ErrNoCookie and log/swallow other decode errors when a best-effort clear is acceptable.
3. Roll out ticket-format changes with a grace period or version check so old cookies are cleared gracefully.
4. Verify no proxy/CDN is truncating or rewriting the Cookie header.

Example fix

// before
if err == http.ErrNoCookie {
    return nil
}
return fmt.Errorf("error decoding ticket to clear session: %v", err)
// after
if errors.Is(err, http.ErrNoCookie) {
    return nil
}
// malformed ticket: cookie will be cleared anyway; log and continue
log.Printf("clearing session with undecodable ticket: %v", err)
tckt.clearCookie(rw, req)
return nil

err := m.Clear(rw, req)
if err != nil && !errors.Is(err, http.ErrNoCookie) {
    // malformed ticket: cookie was already cleared; log and continue
    log.Printf("session clear with bad ticket ignored: %v", err)
    err = nil
}

When it happens

Trigger: Calling Clear on a request whose cookie holds a malformed ticket (wrong number of dot-separated parts, invalid base64 ID/secret) rather than simply missing a cookie.

Common situations: Client cookies corrupted or hand-edited; ticket format changed between library versions (v2 encoding vs old format) leaving stale cookies; proxy mangling cookie values.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• list of cookies must be > 0
• failed to decode ticket Id: %v
• failed to decode encryption secret: %v
• failed to decode ticket: %v
• CSRF cookie failed validation

AI-assisted analysis of oauth2-proxy/oauth2-proxy@33c2eb92de (2026-09-06). Data as JSON: /api/errors/ac7abf7f7b25d9fe. Report an issue: GitHub.