From ac47931283714e51bd86e2aba70e21bb0b1a6c3e Mon Sep 17 00:00:00 2001 From: Jan Eitzinger Date: Wed, 26 Aug 2026 21:13:13 +0200 Subject: [PATCH] Fix session handling with oidc login route --- cmd/cc-backend/server.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/cmd/cc-backend/server.go b/cmd/cc-backend/server.go index 5909fb9d..cd089517 100644 --- a/cmd/cc-backend/server.go +++ b/cmd/cc-backend/server.go @@ -189,7 +189,14 @@ func (s *Server) init() error { if auth.Keys.OpenIDConfig != nil { openIDConnect := auth.NewOIDC(authHandle) - openIDConnect.RegisterEndpoints(s.router) + // The OIDC callback mutates the session (SaveSession renews the token and + // writes the session data), so these routes have to run inside + // scs.LoadAndSave just like /login and /logout. Without it the session + // is missing from the request context and scs panics. + s.router.Group(func(r chi.Router) { + r.Use(sessionManager.LoadAndSave) + openIDConnect.RegisterEndpoints(r) + }) info["hasOpenIDConnect"] = true }