The flow cookies is missing

[baominwang]

I am writing a sample to integrate with Ory Hydra. After login process calls "acceptLoginRequest" and try to redirect. The URL is as following:
http://localhost:3000/callback?error=access_denied&error_description=The+resource+owner+or+authorization+server+denied+the+request.+The+flow+cookie+is+missing+in+the+request.&state=hTo4ViZHcheryXMzzUJMCfjsU42w7-MTVOa9fbMKQmE

What could be root cause?

[vinckr]

Hello @baominwang

The error message you're seeing suggests that the flow cookie is missing in the request. This could be due to a number of reasons. Here are a few possibilities:

• Misconfiguration: As per the debug documentation, misconfiguration is a common cause of OAuth 2.0 authorize code flow failures. Ensure that your setup is correctly configured.
• Reverse Proxy or Load Balancers: If you are running Ory Hydra behind a reverse proxy that strips the Cookie header, this could cause issues. The CSRF documentation mentions that if the reverse proxy supports path rewrites, that might also cause problems.
• Incorrect Redirect URL: The OAuth2-related problems documentation suggests that using the wrong redirect URL could cause your request to fail. The redirect URL must be whitelisted in your client configuration and they must match exactly.
• Insufficient Entropy: As per the FAQ, the request might fail if it uses a security parameter (such as, anti-replay, anti-csrf) with insufficient entropy (minimum of 8 characters).

To troubleshoot further, you can check the logs as Ory Hydra has extensive logging. You can also check the URL for error_hint, error, error_description, error_debug as these might provide more information about the error. If you're just starting out and experimenting, ensure that the host, port, and path are correct. You can also set the environment variable OAUTH2_EXPOSE_INTERNAL_ERRORS=true to get more debug information, but be careful not to do this in production as it might leak important data.
Feel free to check out Ory Network as well, if you just want to test out Hydra it is an easier (and free) option than dealing with deploy, reverse proxies etc. in the start.

[AnastasiyaDidych]

Hello. I have the same issue, but it started to appear when I upgraded from v2.1.0 to v2.2.0
This is a part of log from Hydra

{
  "audience": "audit",
  "error": {
    "debug": "",
    "message": "access_denied",
    "reason": "The flow cookie is missing in the request.",
    "status": "Forbidden",
    "status_code": 403
  },
  "http_request": {
    "headers": {
      "accept-encoding": "gzip",
      "cookie": [
        "oauth2_login_csrf_3297986853=MTY5NjQyNTg2N3xXSm9FMXFzSGRNS0hGaU90VkFBdHFTNVlYQ0I2dDh3Mnh3ZzJzWFI2b0w1X1V1NnFzcVU4WXhES3lYT3QwTlpRMmc3VHlwNG5ocXJOSnRyQmQ4V2pMUlJUbTRvbjJJVjJqZVZwSG1XTmwwODRUcndxR01lN0J2WUhmSWtFR1E9PXyFJX4mbiyBDuoFhKmgui8E82vI2i95SUClWg98DEndfg=="
      ],

Any guesses as to why this could happen?

[vinckr]

There were some breaking changes in v2.2.0, could those be related?

• The client that is used as part of the authorization grant flow is stored in the AEAD-encoding. Therefore, running flows will not observe updates to the client after they were started.
• Because the login and consent challenge values now include the AEAD-encoded flow, their size increased to around 1kB for a flow without any metadata (and increases linearly with the amount of metadata). Please adjust your ingress / gateway accordingly.

[AnastasiyaDidych]

I found the issue
These cookies are mandatory:

ory_hydra_loginsession_***
ory_hydra_flow_***

It would be great to mention such changes anywhere is release notes or documentation

[AnastasiyaDidych]

But now I cannot proceed with the Accept Consent request. This is the error on Hydra

{
  "audience": "application",
  "error": {
    "message": "named insert: ERROR: new row for relation \"hydra_oauth2_flow\" violates check constraint \"hydra_oauth2_flow_check\" (SQLSTATE 23514)"
  },
  "http_request": {
    "headers": {
      "accept-encoding": "gzip",
      "cookie": [
        "oauth2_login_csrf_3297986853=MTY5NjUwMTYwNXxRU1k1ZVg1eGdjVU5LcHFqMFFBSDE2T3lSY2VkTmhvYk1QV2RWMU5DcXJmRG9tQTdGYzE1NU0xUDJIaDFvRzlrWmpSQlhyVTNXWVpoeGJjUHlnS0UzYnBwR1NraTRlX3JWbnVmWGhSVmVsMmJGVklXUTFCYXNvTm5IMHc1WlE9PXzMUJFebh9H4JOWCUG401SEONmJ0dQQTaaRsirf0pbg0g==; oauth2_consent_csrf_3297986853=MTY5NjUwMTYyNXxZekYwVEpwRU5kQTBOenQ5cEVPVl9XVk85RkF3SDl2aUhQNmNFaHpSNF9KbHpfM3R1aXBrNlphdWQ4ekg0TGY4Z2dZVm1zMkZCVWNjN01YYV94LWhtcDZNbnpRSmxDbTFXX1AxQXN3aWNYcTZkdkczT0FBdTd2NFBpaFdkcFE9PXw5IufMdzz6SD6Frro7waA-hqeBundZ_fLi9f1L4Hfveg==; ory_hydra_flow_3297986853=k2hY8DCzxHO_Ibso-8QcJbE1sVmPyvHgSPAlaI2Tam4dI8yuMtsAJIIucVgO8c32sDZPE6e54D6c-H-ilNCDtmCi4wKcPIl7TU347GwzYWXoDpqIL8ebIu4-jcAoaDl0QiOev3muS5vUhaeJ6Kak9oDS0RcH4GVfvUVR9w2wFFtWKakSycplfFga8mUTnx55meE_t0dRVzB4Ww6ehvof5-598I7MmkYmfIOraxfOYux4dFVfC5fnCWJkd5qmaqcUZTdFoxlQjV9BIgEqyryhGR9R0GfeToasR3xiSRaa_5qnlefabIQvyj3GM2qNnqLafmH6qEoxs7-F38WDe7089GlR4lUA32lCbQHhtXYLVDfTLFolAZvik7LCcgjxs2iF_EKQI5wgZMXFApxaz0Bzj6Wc0NfiOf7hsopciWzhxVrVYQXmFPr1bYeb3BBLIxCqVW221aQe07PEKXvyu__2D6CASxCezcowkAfsga53wrbo_HgUWcSowuKPpTt0UiNAOU5NiMfmLG2-qxzKYidhLUCOXDcfa3vGgS6lYOK5nTmArms5bWzzd7y6eLeqhczPwomjagHSOq2nX1iehSbHmLPlCX9_49VROaJ7GY0d-_ByqdCai2HzNZzUPsON5Yb_POV2sSAIThVO8qzEtM2MA7YRdlMaGcVJWFxgQMtaohxM0Jw4-kix3NEan5pz7VqhXp04LvuMM2qhgsvUc0Hd9HcASl2xrNphillEwqSdl_QDLQZNsZ-aHLBwA41m8qTjl_lOvXFzCrI5Os4ySqYJ4pfrTz47CGohqJtV8jW8ChqF_lMrswRQmbi4O8QAVZHaMEQUYvq6dBP21qeCh00cyaseIdFVACMvx476xGQ-Y--51uW6AzpUe4-5WdFlQgiSpiwlhiQ5bRGByS8i2x3qednrM_Ih6MqN9x3i8FrscbPioT4lm83i3xmJKXEjgTdX9fxn3YD4knKSWQlAQ_6QIp5B3A1UFNkRkpnHU0kRr-bX4_qqDeVB0M_JTvxPxuswUxr7FtKw5-nzm8GRcR2I7SzXOyn2NlRq-SbvAy-ssl5q7xaT5FpuV_j3sTYEAr6z1WX8cNQ_Mfq9zZUDfTGtv9w8gb4lJdvn5BLCs9rPOEKaH8yukM96A-pkDVirvyYvCRCIBsNkfXIMwcFe1WRMQFT2ZdgQvvjfDfa4TG_kuKZuFKXZtCs3p91v7A2j48dokdIAIhN87qPYM9jWwA_xBUfYc4aK59__F_EjCj0_ia4WoFFc5ku2WcdZ1QIm209lyr3uYg1zkbqQO7cNqfbezsiBd6i5i8p9NrlYTcugSqO1e5tY5le21rmK2CJAotDzKCc555RApYp_Gp4nUAgtOk-JO_MNasiPjTmji5Km_5NW46K2QHeyxI5JUgdIbEMj-K9Xo-q44GVIbrdREME1mPQz38xW7rHDV1UpRmRzf83qL2aMCY1or4Y_8zJpncC8Fwj_ycD-K5QO76ieQoGOFZAepM6eXKQvhMi3Dw-mWwukdmXRsIkpBY5M6YRw2cDj3fobXrY1yVXb21BdFuyQlWmOffuJc-ol1qx9k1XG9OQiykY498MTfsqBPhkxG0Grwy5vBR1NeDqb_nnqjxL-zmt0uk9Rr82Oykk6dBtDwwbGpEhfZlqGTO306QUOT4M5824elWSg6igbj0QsoPXNh5zMKIkg1jw7vgqhIdQ=; ory_hydra_loginsession_3297986853=alGMdVwSMzp5x_fuuh5KlGsvIDky8SNNORjNb8sUDHR-AN63-AMlb7kzMdxuh4TvZE92UcL7YRQ5Kb3ejlyuGdBxHep5vLwXyZOOR066U7278MP7WHpIHWGjvMmXkSmcTSkuAecS2ZaPEfDXQODdDOmYFqiPb4fraK6zpxIcIPf189R22SFRrCO62qtqV-7NMDR8yFCIEtrhHpMyn0RpNP4erpPXZLg1wXC1v4aHYRvBrvDDei4A3xz3RqPgJu4_OucsShaZe-lCRQXLjsLOEfNlgg=="
      ],
      "l5d-client-id": "/***/",
      "traceparent": "/***/",
      "tracestate": "/***/",
      "user-agent": "Go-http-client/1.1",
      "x-dts-userid": "1c34fcae-29ca-4323-be2b-2c22314eea79",
      "x-session-id": ""
    },
    "host": "/***/",
    "method": "GET",
    "path": "/oauth2/auth",
    "query": "client_id=/****/&consent_verifier=FQzLr_qoJITMy_UCNNJbDGZsNwI_ywRI6SyLzCOBWx...&redirect_uri=/***/&response_type=code&scope=openid+vc_scope&state=61857836-da9f-4e98-bb99-53676a40a2e4",
    "remote": "10.120.3.226:56068",
    "scheme": "http"
  },
  "level": "error",
  "msg": "An error occurred",
  "otel": {
    "span_id": "f1fced4dfb1aeb04",
    "trace_id": "b70cc845a1938c27caf32afec4b1580a"
  },
  "service_name": "Ory Hydra",
  "service_version": "v2.2.0-rc.3",
  "time": "2023-10-05T10:32:32.931252772Z"
}

[markellofff]

getting the same issue as @AnastasiyaDidych.
Can anyone help ?
and @AnastasiyaDidych how did you pass the required cookies?

[AnastasiyaDidych]

@markellofff the team spent few days trying to find a workaround for cookies (caching in code, etc), but we decided not to update to the v2.2.0, but use the v2.1.2 instead

[gosolivs]

Hi! We managed to identify the issue related to hydra_oauth2_flow_check. We had both v2.2.0-rc.3 and v2.2.0 running simultaneously. In our local image repository, an image tagged v2.2.0 was stored, which contained Hydra v2.2.0-rc.3. On February 12, 2024, you released version v2.2.0 and published an image with the same tag v2.2.0 on Docker Hub. Some of our nodes in Kubernetes had v2.2.0-rc.3 cached, running Hydra v2.2.0-rc.3, while others had Hydra v2.2.0. We've rectified the situation by firmly tying to the hash of the image from Docker Hub. @aeneasr perhaps ORY shouldn't publish images of early releases with tags matching final releases.

[gosolivs]

Hello everyone! Any updates on this issue?

[vinckr]

Hello,
what kind of update are you expecting?

[gosolivs]

Hello 👋

Perhaps you've discovered the reason for the errors above. I've been experiencing similar errors in my system in the past few days, although they weren't present before.

[vinckr]

Ah sure. To find the reason for the errors we probably need a reproducible case first. I have no insight into what is going on in other peoples infra.
If this turns out to be an actual bug in v2.2.0 opening an issue with the details and steps to reproduce would be the best course of action.