How I can set my cookies? Those are blocked?

[kshji]

My cgi works fine. But headerlines Set-Cookie: ... not work under this protectd location. Outsite of this I can set my cookies.

<Location /protected>
                AuthType openid-connect
                Require valid-user
</Location>

[kshji]

I found a solution. Not so nice, but works.

1st time do the cgi and on the other times not.

<Location "/protected"> 
 AuthType openid-connect 
 Require valid-user
 RewriteEngine On
  
 # test cookie __Host-server and value
 RewriteCond %{HTTP:Cookie} __Host-server=xxxx
  # if okay then skip 1 cmd
 RewriteRule .* - [S=1]   
 # do this if cookie wasn't set       
 RewriteRule /protected/(.*)$ /cgi-bin/setcookie.cgi?loc=%{SERVER_name} [PT,QSA,L]
                
 Header always set Set-Cookie "myblock=done; Path=/; Max-Age=3600; Secure; HttpOnly"
                
 </Location>

setcookie.cgi. Basic idea is to do somethin and then set cookies + reload page
=> do the Location block but skip the cgi execute line, cookie was set

# script write to the stdout  next template
cat <<EOF
Set-Cookie: __Host-server=xxxx; path=/; Max-Age=3600; Secure; HttpOnly 
Content-type: text/html

<script>location.reload();</script>
EOF

[zandbelt]

that should not be necessary; which version mod_auth_openidc are you using what is OIDCRedirectURI set to?

[kshji]

mod_auth_openidc-2.4.15.1

update:
now 2.4.18.1

OIDCRedirectURI https://myserver/protected/callback

[zandbelt]

works for me as expected, without the rewriting/reloading that you added, using:

#!/bin/sh
cat <<EOF
Set-Cookie: __Host-server=xxxx; path=/; Max-Age=3600; Secure; HttpOnly 
Content-type: text/html

<script>location.reload();</script>
EOF

i.e. adding #!/bin/sh at the top, avoiding the empty line between the headers, and correcting <scrip> to <script>

[kshji]

Sorry, I wasn't copy the script, I fixed previous as the script do it ... cgi-script was done correctly.

If I open ex. page /protected/example.htm, login Google, result is empty page = cgi done, but after I added location.reload, it works fine = second call in the location /protected and cookie has set.

Tested [PT,QSA,L] and [PT,QSA]. Executing stop to the cgi-script, not show url's file.

[zandbelt]

as proven above there's nothing inherently in mod_auth_openidc that prevents this from working so you'll have to simplify your environment until you find the error/interference somewhere in your config/setup