siyuan-note/siyuan · error
Save OIDC login session failed
Error message
Save OIDC login session failed
What it means
OIDC authentication succeeded but session.Save(c) returned an error when persisting the authenticated session. The wrapped error is logged via logging.LogErrorf ("save OIDC session failed: ..."). Because the session could not be saved, the user is not treated as logged in.
Source
Thrown at kernel/model/oidc.go:1008
ret = append(ret, values[0])
}
}
return ret
default:
return nil
}
}
func authenticateOIDCSession(c *gin.Context, rememberMe bool) error {
session := util.GetSession(c)
workspaceSession := util.GetWorkspaceSession(session)
workspaceSession.AccessAuthCode = ""
applyAuthenticatedSession(c, workspaceSession, rememberMe)
util.WrongAuthCount = 0
util.AuthThrottleReset(c.ClientIP())
if err := session.Save(c); err != nil {
logging.LogErrorf("save OIDC session failed: %s", err)
return errors.New("Save OIDC login session failed")
}
util.BroadcastByType("auth", "loginAuth", 0, "", nil)
return nil
}
func secureRandomToken(size int) (string, error) {
buffer := make([]byte, size)
if _, err := rand.Read(buffer); err != nil {
return "", err
}
return base64.RawURLEncoding.EncodeToString(buffer), nil
}
func safeOIDCRedirectTarget(target string) string {
parsed, err := url.Parse(target)
if err != nil || parsed.IsAbs() || strings.HasPrefix(target, "//") || !strings.HasPrefix(target, "/") ||
strings.Contains(target, "\\") {
return "/"View on GitHub (pinned to 251596fc0d)
Solutions
- Read the kernel log for the wrapped error: "save OIDC session failed: <reason>".
- If cookie-overflow, reduce the session payload or switch session storage configuration.
- Confirm write permissions and temp space for the session store.
- Retry login once the underlying persistence issue is cleared.
Defensive patterns
Strategy: try-catch
Try / catch
// Surface the wrapped save error so the operator can diagnose the session store.
if err := session.Save(c); err != nil {
logging.LogErrorf("save OIDC session failed: %s", err)
return fmt.Errorf("could not persist login session: %w", err)
} Prevention
- Keep the session payload small to avoid cookie-size limits.
- Ensure the session store directory/temp space is writable by the kernel process.
- Monitor kernel logs for 'save OIDC session failed' and address the wrapped cause.
When it happens
Trigger: The session store cannot encode or write the session - cookie overflow (session payload too large for the cookie/store limit), store backend write failure, or serialization failure.
Common situations: Session cookie exceeds browser/proxy size limits because of large session data; session store directory not writable; serialization of an unexpected type inside the session.
Related errors
- OIDC login binding does not match
- OIDC nonce does not match
- OIDC state is missing
- OIDC login transaction was not found or has expired
- OIDC authorization code is missing
AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12).
Data as JSON: /api/errors/4638eaf17316fee8.
Report an issue: GitHub.