siyuan-note/siyuan · error

Save OIDC login session failed

Error message

Save OIDC login session failed

What it means

After successful OIDC authentication, authenticateOIDCSession writes the authenticated workspace session via the gin session store (cookie or backend). If session.Save fails — e.g. the response writer already committed, cookie serialization fails, or the store errors — the login cannot be persisted, so it returns this error after logging details.

Solutions

1. Check kernel logs for the preceding 'save OIDC session failed: %s' line to see the underlying store error
2. Reduce session payload size (avoid storing large values) so the auth cookie fits browser limits
3. Verify a stable session store secret is configured and shared across kernel restarts/replicas
4. Ensure the callback handler saves the session before writing any response body or headers
5. Test with a direct kernel connection (no proxy) to rule out Set-Cookie interference

Example fix

// before
util.BroadcastByType("auth", "loginAuth", 0, "", nil)
if err := session.Save(c); err != nil { ... } // headers already committed
// after
if err := session.Save(c); err != nil { ... return err }
util.BroadcastByType("auth", "loginAuth", 0, "", nil)

// Go: save the session before any response write so headers are not committed
// (structural check, not pre-callable)
if c.Writer.Written() { return errors.New("response already committed; cannot save session") }

if err := model.OIDCCallback(c, code); err != nil && strings.Contains(err.Error(), "Save OIDC login session failed") {
    logging.LogErrorf("oidc session save failed: %v", err)
    renderAuthError(c, "Could not establish your session; please retry login")
}

When it happens

Trigger: OIDCCallback, OIDCMobileCallback, OIDCPoll, or OIDCValidateActivate completes authentication but session.Save(c) returns an error — response already written, oversized session cookie exceeding the 4KB browser limit, secure-cookie encode failure due to bad secret, or a disconnected client.

Common situations: Cookie store secret misconfigured or rotated mid-session; session data too large for a cookie; calling the callback twice so headers are already sent; reverse proxy stripping Set-Cookie headers causing client-side churn (rare save failure); client closed connection before headers flushed.

Related errors

• A loopback OIDC redirect URL is required for local access
• A public HTTPS OIDC redirect URL is required for remote…
• agent runtime turn is not finalized
• decode OIDC claims failed
• Desktop OIDC login requires a loopback listener

AI-assisted analysis of siyuan-note/siyuan@9f775e8a12 (2026-09-19). Data as JSON: /api/errors/4638eaf17316fee8. Report an issue: GitHub.

Appendix: source

Thrown at kernel/model/oidc.go:948

				ret = append(ret, values[0])
			}
		}
		return ret
	default:
		return nil
	}
}

func authenticateOIDCSession(c *gin.Context, rememberMe bool) error {
	session := util.GetSession(c)
	workspaceSession := util.GetWorkspaceSession(session)
	workspaceSession.AccessAuthCode = ""
	applyAuthenticatedSession(c, workspaceSession, rememberMe)
	util.WrongAuthCount = 0
	util.AuthThrottleReset(c.ClientIP())
	if err := session.Save(c); err != nil {
		logging.LogErrorf("save OIDC session failed: %s", err)
		return errors.New("Save OIDC login session failed")
	}
	util.BroadcastByType("auth", "loginAuth", 0, "", nil)
	return nil
}

func secureRandomToken(size int) (string, error) {
	buffer := make([]byte, size)
	if _, err := rand.Read(buffer); err != nil {
		return "", err
	}
	return base64.RawURLEncoding.EncodeToString(buffer), nil
}

func safeOIDCRedirectTarget(target string) string {
	parsed, err := url.Parse(target)
	if err != nil || parsed.IsAbs() || strings.HasPrefix(target, "//") || !strings.HasPrefix(target, "/") ||
		strings.Contains(target, "\\") {
		return "/"

View on GitHub (pinned to 9f775e8a12)