Session states do not match exception

[robintw]

I've run into a strange problem where I'm suddenly getting a Session states do not match error when trying to login in my app using fastapi_aad_auth. Everything was working fine and then I suddenly started getting this error, and I'm pretty sure I haven't changed anything.

I can see that the error is raised from state.py, line 91:

fastapi_aad_auth/src/fastapi_aad_auth/_base/state.py

Line 91 in 4089ca0

raise AuthenticationError("Session states do not match")

Are you able to provide any information on why there might be a mismatch in session states occurring here? I've tried this on two different computers with two different AAD logins, and it is occurring in both situations. I've tried running locally and it is working fine, so I'm only running into the error on the version that is hosted on Azure. I've tried restarting the Azure Functions app, and that hasn't solved it.

Also, on a different note: my boss has just pointed out that I'm working for the same company as you! I'm working with Sam Murphy.

[djpugh]

If you are running multi-threaded/multi-instance, you will need to set the session secrets as env vars so they are consistent e.g. across functions

[djpugh]

See

fastapi_aad_auth/src/fastapi_aad_auth/config.py

Lines 99 to 109 in 4089ca0

	class AuthSessionConfig(BaseSettings):
	"""Authentication Session configuration.
	Contains secret and salt information (should be set as environment
	variables in a multi-worker/multi-processing environment to enable
	authentication across workers)
	"""
	secret: SecretStr = Field(default_factory=lambda: str(uuid.uuid4()), description="Secret used for encoding authentication information",
	env='SESSION_AUTH_SECRET')
	salt: SecretStr = Field(default_factory=lambda: str(uuid.uuid4()), description="Salt used for encoding authentication information",
	env='SESSION_AUTH_SALT')

[robintw]

Thanks, that's solved the problem :)

I'll see if I can find an appropriate place to put this in the docs and do a PR.

[djpugh]

It's in https://djpugh.github.io/fastapi_aad_auth/module/fastapi_aad_auth.config.html, but suggest putting into usage.rst - https://djpugh.github.io/fastapi_aad_auth/usage.html