Kibana session logout after opening a new tab

1

Hi,

A few users have reported a session logout in Kibana after opening a new tab. The reported steps to reproduce are:

  1. Using SAML integration as authentication
  2. Login into Kibana
  3. Click on a link that opens in a new tab Kibana

Result:
The session on the first tab is lost

Expected:
No session lost

Thanks in advance

1 Like
2

Thanks, interesting one. Any insights on what browser does this?

3

I have just tried to reproduce this, but no luck.

  • what version of ROR have you installed? Es and Kibana plugins
  • what version of ES/KBN?
  • can you reproduce this in chrome?
  • can you provide a more precise reproducer script? I.e. what link to click
  • can you share the settings of your kibana.yml? i.e. session related parameters
4

Hi,

It is happening in Safari as well as Firefox in Ubuntu. But could be happening in other browsers that I am not aware.

  • what version of ROR have you installed? Es and Kibana plugins
    Version 1.49

  • what version of ES/KBN?
    Version 7.16.3

  • can you reproduce this in chrome?
    Will check.

  • can you provide a more precise reproducer script? I.e. what link to click
    This type of links (the short links generated in Kibana):
    https://logs.xcade.net/s/testteam/goto/e0323b20-27bb-11ee-9e09-fd2bb6486a07

  • can you share the settings of your kibana.yml? i.e. session related parameters
    The only setting related to session is readonlyrest_kbn.session_timeout_minutes: 720

Thanks in advance

1 Like
5

Not able to reproduce in 1.50.0 with Kibana 8.8.0.

If there is a problem with how I test, let me know. Otherwise I will try install Kibana 7.16.3.

6

Hi @sscarduzio

The steps to reproduce are not exactly the same. After creating the short link, share it to yourself via email. Then click on the link from the email.

Best regards.

7

Test!

https://localhost:5601/s/default/app/r/s/fKXHn

8

You know, I was skeptical. But here I am reproducing this issue. Pretty sure there’s a rational explanation, but for now it really puzzles me.

@Dzuming WDYT? I need ideas :slight_smile:

9

Seems like, it’s a problem related to the Gmail and the way you open the link.

Generally speaking, in our cookies we have a sameSite: strict value defined in our rorCookie. However, if you left mouse click, the link in Gmail, opens something like https://www.google.com/url?q=https://localhost:5601/s/default/app/r/s/Uxo0E&source=gmail&ust=1692032548974000&usg=AOvVaw3E9LWSwc41dX7RAlfolDvf and in this case, rorCookie is not attached to the cookie header. If you open the link via Open link in new Tab option, it works as expected. To fix this issue, we can change rorCookie sameSiite to the Lax.

10

Hi @Dzuming

In our case, we are not using Gmail for sharing the links. Our use case is very similar to the one tested by @sscarduzio by posting a link in this thread.

Best regards.

11

@Dzuming your reasoning makes sense to me. Let’s try if sameSite: 'lax' fixes the issue at hand, and later we can make it configurable.

12

Hi @sscarduzio

Any updates on this issue?

Thanks in advance.

13

@Dzuming can we give a build to @gustavo.yoshizaki?

14

I sent a private message with a pre-release build to @gustavo.yoshizaki

1 Like