Deck session cookies are not valid for the configured lifetime

Uses: Kong Gateway

TL;DR

Why does the session cookie expire before the configured cookie_lifetime?

Each deck ping call generates a new session cookie on the Kong server, so two valid cookies briefly exist. The original cookie is discarded after cookie_discard (default 10 seconds), which is shorter than cookie_lifetime, and deck has no way to retrieve the updated cookie. Increase cookie_discard in admin_gui_session_conf to match cookie_lifetime so the original cookie stays valid for its full lifetime.

Problem

The admin_gui_session_conf has been set to have a cookie_lifetime of 600 seconds:

admin_gui_session_conf={ "cookie_name": "manager-session", "secret": "this_is_my_other_secret", "storage": "kong", "cookie_secure":true, "cookie_lifetime":600}"

Copied!

An authentication cookie is retrieved:

curl -k https://api.kong.lan/auth -u "kong_admin:password" -H "kong-admin-user:kong_admin" -c /tmp/cookie

Copied!

and deck ping initially works fine using the cookie:

deck ping --kong-cookie-jar-path /tmp/cookie --tls-skip-verify -w default --kong-addr https://api.kong.lan --headers kong-admin-user:kong_admin --headers "user-agent:curl/7.82.0"
Successfully connected to Kong!
Kong version:  3.14.0.0-enterprise-edition

Copied!

After waiting approximately 10 seconds, the same deck ping command fails:

deck ping --kong-cookie-jar-path /tmp/cookie --tls-skip-verify -w default --kong-addr https://api.kong.lan --headers kong-admin-user:kong_admin --headers "user-agent:curl/7.82.0"
Error: reading Kong version: HTTP status 401 (message: "Unauthorized")

Copied!

The session cookie expires before the configured cookie_lifetime of 600 seconds elapses.

Cause

When the deck ping command is run, a new session cookie is generated on the Kong server. This means that there are now two valid cookies. The original, older cookie is discarded after the cookie_discard time, which defaults to 10 seconds.

Solution

Currently, there is no way for deck to retrieve the updated session cookie and it will be necessary to increase the cookie_discard time to allow the original cookie to be used for the full lifetime. For example, change the admin_gui_session_conf as per the example below by adding the cookie_discard parameter:

admin_gui_session_conf={ "cookie_name": "manager-session", "secret": "this_is_my_other_secret", "storage": "kong", "cookie_secure":true, "cookie_lifetime":600, "cookie_discard":600}"

Copied!

Deck session cookies are not valid for the configured lifetime

Problem

Cause

Solution

Help us make these docs great!

Still need help?