Login not working if random cookie with size greater than 1975 is set

[eloo]

Describe the issue you are experiencing

Hi,
i have found that the Login is not working if a random cookie with a size greater than 1975 (not sure if this is the correct number) is set.

I have encountered this because my SSO setup (oauth-proxy & authelia) is setting such a big cookie (around 2400).

I thought first its related to the cookie name or something but it seems that its only the cookie size.
So a random cookie for your site would "work" here.

Maybe its related to some max-request-size config of lighttpd or something in raspberrymatic itself.

Describe the behavior you expected

I would expect that a random issue does not produce login issues.

Steps to reproduce the issue

1. Open the Raspberry Matic Login Page
2. Open Developer tools in your browser
3. Go to Application
4. Go to Cookies
5. Add a Cookie with a size around 2000 (check example from screenshot) (maybe you need greater cookies)
6. Try to login
7. Get redirect to login page instead of being logged in
8. Go again into the cookies tab
9. Reduce the size of the cookie
10. Try again
11. Get logged in

What is the version this bug report is based on?

3.73.9.20231130

Which base platform are you running?

oci (Open Container Infrastructure)

Which HomeMatic/homematicIP radio module are you using?

n/a

Anything in the logs that might be useful for us?

no

Additional information

No response

[jens-maus]

Thanks for this interesting observation. I could perfectly reproduce that issue. However, didn't find any quick solution/fix for it. Perhaps someone else (@jp112sdl ?) might have an idea where exactly such long cookies are currently blocking the WebUI logins...

[jp112sdl]

Maybe lighttpd-error.log helps:

2024-01-20 22:16:49: (../src/http-header-glue.c.1341) read() 140 63: Connection reset by peer
2024-01-20 22:16:49: (../src/gw_backend.c.2396) response already sent out, but backend returned error on socket: tcp:127.0.0.1:8183 for /pages/index.htm?NoAutoLogin=true, terminating connection

I don't have other suggestions or ideas

[eloo]

@jens-maus i'm glad that you could reproduce it 👍
at least now it known :D

but yes thats a really weird issue.
my best guess so far is that "some component" here has issues handling such big headers..
as i have not found anything in the lighttpd config here (and i guess such a known http-server can handle such cookies or would throw a proper error) i guess it related to the "upstream" component...

but i really don't have any idea what component that is.. something in OCCU maybe which is serving the APIs and WebUI.

but thats just guessing as im not familiar with the whole components here

[jens-maus]

Ok, after some further investigation it seems this is a bug/issue in the internal web server of the ReGaHss logic engine component in the CCU/OCCU. It seems some internal buffer size is exceeded in case a large HTTP header is submitted to the web server, making it unable to parse the login part accordingly. Thus, this needs some further investigation and fix.

[jens-maus]

@eloo Please note that with the next nightly snapshot RaspberryMatic will come with ReGaHss R1.00.0388.0237 which should fix this issue. So if you can please re-test then and see if everything is working as expected.

[eloo]

@jens-maus just tested the latest version and it looks like the fix is working as expected
i can login while having a 2500 bytes cookie..

thanks