Fix OAuth redirect loop and improve session security configuration

OAuth Improvements:
- Fix infinite redirect loop by implementing a "Direct Login Hijack" flow for Google, GitHub, and Generic providers.
- Move OAuth token storage from session cookies to the database to prevent "Cookie Too Large" errors.
- Ensure `SESSION_COOKIE_SECURE` is automatically enforced when OAuth is enabled.

Security & Configuration:
- Add new "Use via HTTPS" setting to Basic Configuration. This allows administrators to enforce `Secure` and `SameSite=Lax` cookies on standard/LDAP logins when running over HTTPS.
- Update application initialization to dynamically configure cookie security based on login type and settings.
- Clarify "Allow Reverse Proxy Authentication" setting description in the UI.
- Add static warning in OAuth settings emphasizing the HTTPS requirement.

Database:
-Fix OAuth redirect loop and improve session security configuration

OAuth Improvements:
- Fix infinite redirect loop by implementing a "Direct Login Hijack" flow for Google, GitHub, and Generic providers.
- Move OAuth token storage from session cookies to the database to prevent "Cookie Too Large" errors.
- Ensure `SESSION_COOKIE_SECURE` is automatically enforced when OAuth is enabled.

Security & Configuration:
- Add new "Use via HTTPS" setting to Basic Configuration. This allows administrators to enforce `Secure` and `SameSite=Lax` cookies on standard/LDAP logins when running over HTTPS.
- Update application initialization to dynamically configure cookie security based on login type and settings.
- Clarify "Allow Reverse Proxy Authentication" setting description in the UI.
- Add static warning in OAuth settings emphasizing the HTTPS requirement.

Database:
-Add config_use_https column to settings table.

Author: crocodilestick

CONTRIBUTORS

@@ -11,7 +11,7 @@ Copyright (C) 2018-2025 Calibre-Web contributors
 Copyright (C) 2024-2025 Calibre-Web Automated contributors
 # Upstream Contributors (janeczku/calibre-web)
 
-- OzzieIsaacs (anon) (2769 commits)
+- OzzieIsaacs (anon) (2771 commits)
 - Ozzie Isaacs (anon) (264 commits)
 - cbartondock (96 commits)
 - idalin (69 commits)
@@ -38,7 +38,7 @@ Copyright (C) 2024-2025 Calibre-Web Automated contributors
 - kyos (anon) (18 commits)
 - quarz12 (18 commits)
 - Thore Schillmann (anon) (18 commits)
-- mapi68 (13 commits)
+- mapi68 (14 commits)
 - ok11 (13 commits)
 - pwr (13 commits)
 - Kyosfonica (11 commits)
@@ -52,6 +52,7 @@ Copyright (C) 2024-2025 Calibre-Web Automated contributors
 - XZVB12 (10 commits)
 - celogeek (9 commits)
 - GarckaMan (9 commits)
+- IgorKurkov (9 commits)
 - Knepherbird (9 commits)
 - Yamakuni (anon) (9 commits)
 - 89jd (8 commits)

cps/__init__.py

@@ -17,6 +17,7 @@
 from werkzeug.middleware.proxy_fix import ProxyFix
 
 from . import logger
+from . import constants
 from .cli import CliParameter
 from .reverseproxy import ReverseProxied
 from .server import WebServer
@@ -74,6 +75,7 @@
 app = Flask(__name__)
 app.config.update(
     SESSION_COOKIE_HTTPONLY=True,
+    SESSION_COOKIE_SECURE=os.environ.get('SESSION_COOKIE_SECURE', 'False').lower() == 'true',
     SESSION_COOKIE_SAMESITE='Lax',
     REMEMBER_COOKIE_SAMESITE='Strict',
     WTF_CSRF_SSL_STRICT=False,
@@ -125,6 +127,18 @@ def create_app():
     config_sql.load_configuration(ub.session, encrypt_key)
     config.init_config(ub.session, encrypt_key, cli_param)
 
+    # Intelligent Security Configuration
+    # Force SESSION_COOKIE_SECURE if OAuth is enabled OR if "Use via HTTPS" is checked
+    # This ensures OAuth works (requires Secure cookies) while allowing HTTP for standard login if desired
+    if config.config_login_type == constants.LOGIN_OAUTH or getattr(config, 'config_use_https', False):
+        app.config['SESSION_COOKIE_SECURE'] = True
+        app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
+        log.info("Enforcing SESSION_COOKIE_SECURE=True (OAuth enabled or HTTPS enforced)")
+    else:
+        # Fallback to environment variable or False
+        app.config['SESSION_COOKIE_SECURE'] = os.environ.get('SESSION_COOKIE_SECURE', 'False').lower() == 'true'
+        log.info(f"SESSION_COOKIE_SECURE set to {app.config['SESSION_COOKIE_SECURE']} (Standard/LDAP login)")
+
     # Set OAuth redirect host consistency
     if hasattr(config, 'config_oauth_redirect_host') and config.config_oauth_redirect_host:
         from urllib.parse import urlparse

cps/config_sql.py

@@ -86,6 +86,7 @@ class _Settings(_Base):
     config_anonbrowse = Column(SmallInteger, default=0)
     config_public_reg = Column(SmallInteger, default=0)
     config_remote_login = Column(Boolean, default=False)
+    config_use_https = Column(Boolean, default=False)
     config_kobo_sync = Column(Boolean, default=False)
 
     # Sync read progress to Hardcover - should this be renamed?

cps/oauth.py

@@ -11,10 +11,20 @@
     from flask_dance.consumer.storage.sqla import SQLAlchemyStorage as SQLAlchemyBackend
     from flask_dance.consumer.storage.sqla import first, _get_real_user
     from sqlalchemy.orm.exc import NoResultFound
-    backend_resultcode = False  # prevent storing values with this resultcode
+    backend_resultcode = True  # prevent storing values with this resultcode
 except ImportError:
     pass
 
+import logging
+def debug_log(msg):
+    try:
+        # Try writing to a location we know exists and is writable in the container
+        with open('/tmp/oauth_debug.log', 'a') as f:
+            f.write(msg + '\n')
+    except Exception as e:
+        print(f"Logging failed: {e}")
+
+
 
 class OAuthBackend(SQLAlchemyBackend):
     """
@@ -30,8 +40,21 @@ def __init__(self, model, session, provider_id,
         super(OAuthBackend, self).__init__(model, session, user, user_id, user_required, anon_user, cache)
 
     def get(self, blueprint, user=None, user_id=None):
-        if self.provider_id + '_oauth_token' in session and session[self.provider_id + '_oauth_token'] != '':
-            return session[self.provider_id + '_oauth_token']
+        debug_log(f"GET called. Provider: {self.provider_id}")
+        
+        # Debug session contents
+        try:
+            debug_log(f"Session keys: {list(session.keys())}")
+        except:
+            pass
+
+        if self.provider_id + '_oauth_token' in session:
+            debug_log(f"Found token in session for {self.provider_id}")
+            if session[self.provider_id + '_oauth_token'] != '':
+                return session[self.provider_id + '_oauth_token']
+        else:
+            debug_log(f"Token NOT in session for {self.provider_id}")
+
         # check cache
         cache_key = self.make_cache_key(blueprint=blueprint, user=user, user_id=user_id)
         token = self.cache.get(cache_key)
@@ -106,6 +129,14 @@ def set(self, blueprint, token, user=None, user_id=None):
             if has_user and u:
                 existing_query = existing_query.filter_by(user=u)
 
+        # Check if token is already saved (e.g. by oauth_update_token) to avoid redundant delete/insert
+        try:
+            existing = existing_query.first()
+            if existing and existing.token == token:
+                return
+        except Exception:
+            pass
+
         # queue up delete query -- won't be run until commit()
         existing_query.delete()
 

cps/oauth_bb.py

@@ -408,8 +408,38 @@ def logout_oauth_user():
 
 
 def oauth_update_token(provider_id, token, provider_user_id):
+    try:
+        with open('/tmp/oauth_debug.log', 'a') as f:
+            f.write(f"oauth_update_token called for {provider_id}, user {provider_user_id}\n")
+            f.write(f"Session before update: {list(session.keys())}\n")
+    except:
+        pass
+
+    # Aggressively clean up potential duplicate tokens to prevent cookie overflow (4KB limit)
+    # We remove ALL token data from session and rely on DB storage
+    keys_to_remove = [
+        'google_oauth_token', 'github_oauth_token', 'generic_oauth_token',
+        provider_id + "_oauth_token"
+    ]
+    for key in keys_to_remove:
+        if key in session:
+            try:
+                session.pop(key)
+                with open('/tmp/oauth_debug.log', 'a') as f:
+                    f.write(f"Removed {key} from session to save space\n")
+            except:
+                pass
+
     session[provider_id + "_oauth_user_id"] = provider_user_id
-    session[provider_id + "_oauth_token"] = token
+    # Do NOT store token in session - it's too big and causes cookie drop
+    # session[provider_id + "_oauth_token"] = token 
+    session.modified = True
+
+    try:
+        with open('/tmp/oauth_debug.log', 'a') as f:
+            f.write(f"Session after update: {list(session.keys())}\n")
+    except:
+        pass
 
     # Find this OAuth token in the database, or create it
     query = ub.session.query(ub.OAuth).filter_by(
@@ -725,7 +755,16 @@ def github_logged_in(blueprint, token):
 
         github_info = resp.json()
         github_user_id = str(github_info["id"])
-        return oauth_update_token(str(oauthblueprints[0]['id']), token, github_user_id)
+        
+        # Save token to DB
+        oauth_update_token(str(oauthblueprints[0]['id']), token, github_user_id)
+        
+        # DIRECT LOGIN: Hijack flow to prevent redirect loop
+        response = bind_oauth_or_register(oauthblueprints[0]['id'], github_user_id, 'github.login', 'github')
+        if response:
+            abort(response)
+            
+        return False
 
 
     @oauth_authorized.connect_via(oauthblueprints[1]['blueprint'])
@@ -735,6 +774,9 @@ def google_logged_in(blueprint, token):
             log.error("Failed to log in with Google")
             return False
 
+        # We do NOT store token in session["google_oauth_token"] here to avoid duplication/bloat.
+        # It will be stored in session[provider_id + "_oauth_token"] by oauth_update_token.
+
         resp = blueprint.session.get("/oauth2/v2/userinfo")
         if not resp.ok:
             flash(_("Failed to fetch user info from Google."), category="error")
@@ -743,7 +785,20 @@ def google_logged_in(blueprint, token):
 
         google_info = resp.json()
         google_user_id = str(google_info["id"])
-        return oauth_update_token(str(oauthblueprints[1]['id']), token, google_user_id)
+        
+        # Save token to DB
+        oauth_update_token(str(oauthblueprints[1]['id']), token, google_user_id)
+        
+        # DIRECT LOGIN: Hijack flow to prevent redirect loop
+        # We perform the binding/login logic right here
+        response = bind_oauth_or_register(oauthblueprints[1]['id'], google_user_id, 'google.login', 'google')
+        
+        # If we got a response (redirect), abort the current request and send it immediately
+        # This stops Flask-Dance from doing its own redirect to /link/google
+        if response:
+            abort(response)
+            
+        return False
 
 
     @oauth_authorized.connect_via(oauthblueprints[2]['blueprint'])
@@ -757,7 +812,14 @@ def generic_logged_in(blueprint, token):
             # Pass token explicitly to avoid DB race condition
             provider_user_id = register_user_from_generic_oauth(token)
             if provider_user_id:
-                return oauth_update_token(str(oauthblueprints[2]['id']), token, provider_user_id)
+                # Save token to DB
+                oauth_update_token(str(oauthblueprints[2]['id']), token, provider_user_id)
+                
+                # DIRECT LOGIN: Hijack flow to prevent redirect loop
+                response = bind_oauth_or_register(oauthblueprints[2]['id'], provider_user_id, 'generic.login', 'generic')
+                if response:
+                    abort(response)
+                return False
             else:
                 # register_user_from_generic_oauth already logged error and flashed message
                 return False
@@ -830,6 +892,8 @@ def generic_error(blueprint, error, error_description=None, error_uri=None):
 @oauth.route('/link/github')
 @oauth_required
 def github_login():
+    # This route is now only a fallback if the direct login hijack fails
+    # or if the user navigates here manually.
     if not github.authorized:
         return redirect(url_for('github.login'))
     try:
@@ -859,13 +923,40 @@ def github_login_unlink():
 @oauth.route('/link/google')
 @oauth_required
 def google_login():
+    # Try to find token in session using the provider ID key
+    provider_id = str(oauthblueprints[1]['id'])
+    user_id_key = provider_id + "_oauth_user_id"
+    
+    # 1. Try to get User ID from session (Small cookie!)
+    if user_id_key in session:
+        provider_user_id = session[user_id_key]
+        
+        # 2. Fetch the huge token from Database instead of session
+        oauth_entry = ub.session.query(ub.OAuth).filter_by(
+            provider=provider_id,
+            provider_user_id=provider_user_id
+        ).first()
+        
+        if oauth_entry and oauth_entry.token:
+            # 3. Manually inject token into blueprint
+            google.token = oauth_entry.token
+            
+            # 4. Proceed directly to login
+            return bind_oauth_or_register(oauthblueprints[1]['id'], provider_user_id, 'google.login', 'google')
+
     if not google.authorized:
         return redirect(url_for("google.login"))
+    
     try:
+        # If google.authorized is False but we have a token, google.get might fail
+        # We can try to use the token directly with requests if needed, but let's try google.get first
+        # If google.token was set, google.get should use it
+        
         resp = google.get("/oauth2/v2/userinfo")
         if resp.ok:
             account_info_json = resp.json()
             return bind_oauth_or_register(oauthblueprints[1]['id'], account_info_json['id'], 'google.login', 'google')
+        
         flash(_("Google Oauth error, please retry later."), category="error")
         log.error("Google Oauth error, please retry later")
     except (InvalidGrantError, TokenExpiredError) as e:
@@ -876,6 +967,9 @@ def google_login():
         flash(_("Google Oauth error: {}").format(e), category="error")
         log.error(e)
         return redirect(url_for("google.login"))
+    except Exception as e:
+        log.error(f"Unexpected error: {e}")
+        
     return redirect(url_for('web.login'))
 
 
@@ -888,6 +982,8 @@ def google_login_unlink():
 @oauth.route('/link/generic')
 @oauth_required
 def generic_login():
+    # This route is now only a fallback if the direct login hijack fails
+    # or if the user navigates here manually.
     if not oauthblueprints[2]['blueprint'].session.authorized:
         return redirect(url_for("generic.login"))
     try:

cps/templates/config_edit.html

@@ -246,6 +246,12 @@ <h4 class="settings-section-header">{{_('Feature Configuration')}}</h4>
     <div class="form-group">
       <input type="checkbox" id="config_allow_reverse_proxy_header_login" name="config_allow_reverse_proxy_header_login" data-control="reverse-proxy-login-settings" {% if config.config_allow_reverse_proxy_header_login %}checked{% endif %}>
       <label for="config_allow_reverse_proxy_header_login">{{_('Allow Reverse Proxy Authentication')}}</label>
+      <div class="help-block">{{_('Trusts the "Remote-User" header from a reverse proxy for authentication. This is an authentication method, distinct from the HTTPS security setting below.')}}</div>
+    </div>
+    <div class="form-group">
+        <input type="checkbox" id="config_use_https" name="config_use_https" {% if config.config_use_https %}checked{% endif %}>
+        <label for="config_use_https">{{_('Use via HTTPS')}}</label>
+        <div class="help-block">{{_('Enables secure cookie settings (Secure, SameSite=Lax). Enable this ONLY if you are accessing the server via HTTPS, otherwise you will be locked out.')}}</div>
     </div>
     <div data-related="reverse-proxy-login-settings">
       <div class="form-group">
@@ -268,7 +274,7 @@ <h4 class="settings-section-header">{{_('Feature Configuration')}}</h4>
            <option value="1" {% if config.config_login_type == 1 %}selected{% endif %}>{{_('Use LDAP Authentication')}}</option>
            {% endif %}
            {% if feature_support['oauth'] %}
-           <option value="2" {% if config.config_login_type == 2 %}selected{% endif %}>{{_('Use OAuth')}}</option>
+           <option value="2" {% if config.config_login_type == 2 %}selected{% endif %}>{{_('Use OAuth (requires HTTPS)')}}</option>
            {% endif %}
         </select>
       </div>
@@ -381,6 +387,9 @@ <h4 class="text-center">{{_('Following Settings are Needed For User Import')}}</
       {% endif %}
       {% if feature_support['oauth'] %}
         <div data-related="login-settings-2">
+          <p class="text-danger" style="margin-top: 2rem; background: #ffe9ec; padding: 1rem; border-left: 4px solid #a94442; padding-inline: 2rem; margin-bottom: 2rem;">
+            <strong>{{_('Important:')}}</strong> {{_('OAuth authentication requires this server to be accessed via HTTPS. If you are using HTTP, login will fail.')}}
+          </p>
           {% set generic = provider | selectattr('provider_name', 'equalto', 'generic') | first %}
           <p>{{ _('Generic OAuth Provider') }}</p>
 
@@ -628,6 +637,9 @@ <h4 class="settings-section-header">{{_('Security Settings')}}</h4>
     }
   });
 
+  // Trigger change on load to set initial state
+  $('#config_login_type').trigger('change');
+
   $('#test_oidc_connection').on('click', function() {
     var serverUrl = $('#config_generic_oauth_server_url_test').val() || $('#config_generic_oauth_server_url').val();
     var resultSpan = $('#oidc_test_result');