Sporadic redirects by IAP despite valid cookie (recent development, started on Friday 14th January 2022)

Question

Since Friday all of our users are seeing sporadic 302s when trying to access our in-GCP IAP protected resources. Cookies are valid, and definitely being passed with the request.

This has worked for us for two years and nothing has changed here recently past standard GKE upgrades.

Since Friday we're seeing sporadic 302s from IAP (X-Goog-IAP-Generated-Response: true) as if the cookie is invalid. I can recreate this problem using a simple curl command, with my cookie stored in a file called cookie.test.

`curl -vs -b ./cookie.test https://gitlab.mydomain.com/projects/myapp.git

This succeeds maybe 1 out of 5 times. Behaviour is very recreatable. 2 out of 5 times we'll get a response from gitlab.mydomain.com and the other 3 times we'll see a 303 to accounts.google.com. Same cookie every time, all requests within a few seconds of each other.

This is causing an enormous inconvenience for our team.

Has there been a change to IAP recently that might explain this? Do you have any other reports of similar behaviour?

Answer 1

I have also started facing this issue since last week and have spent around 2 days troubleshooting it as initially we thought that it must be some problem on our side.

Good to know that I am not the only one facing it. Would really appreciate some updates from Google Around it.

However, one thing I found:- There was one official blog from google around IAP:- https://cloud.google.com/blog/products/identity-security/getting-started-with-cloud-identity-aware-proxy they have updated this blog on 19th January and removed the mention of the cookie:- GCP_IAAP_AUTH_TOKEN However, the line they have changed is still unclear to me and very confusing It now says :-

That token can come from either a browser cookie or, for programmatic access, from an Authorization: bearer header.

From where will the browser cookie come, what will be its name, there is no mention around it. Let me know if someone finds a way to get it work again.

Thanks, Nishant Shah

Answer 2

Folks,

I am from the IAP team at Google. Recently IAP has made some changes to the cookie name. However, this change should have been transparent to the browser users. For people using GCP_IAAP_AUTH_TOKEN cookie name for programmatic auth, your flows will break. The documented way to send credentials in a programmatic call is to use Authorization / Proxy-Authorization header.

https://cloud.google.com/iap/docs/authentication-howto#authenticating_a_user_account

Cookies are meant to be used for browser flows only and IAP holds complete control of the naming and format of the cookie. If you continue to use cookies to send in credentials to IAP (by reverse engineering the new format), you run a risk of being broken again by future changes in cookie name/format.

One clarification is required though. In the original post, it was mentioned that you are getting a response of 302 to accounts.google.com, is that true for browser flows also? If so, please respond back with a har file and I'll be happy to take a look.

cheers.