Console nginx uses default client-header buffers — large OIDC tokens cause HTTP 400

[lexfrei]

Describe the bug

The console image serves the SPA and reverse-proxies the Kubernetes API through an nginx config baked into the Containerfile (the inline heredoc written to /etc/nginx/conf.d/default.conf). That config sets neither client_header_buffer_size nor large_client_header_buffers, so both stay at the nginx defaults (1k and 4 8k).

When OIDC is enabled and the IdP issues a large access token — e.g. a user carrying many group claims from an external IdP — the bearer token / kc-access cookie pushes the request headers past those defaults, and nginx returns 400 Bad Request: request header or cookie too large before the request reaches the /apis, /api, or /k8s/ upstream.

Where

Containerfile, the server { ... } block in the /etc/nginx/conf.d/default.conf heredoc. All three proxy locations (/apis, /api, /k8s/) forward the oversized client request headers upstream, so the request is rejected at this nginx layer.

Suggested fix

Raise the header buffers in that nginx config (server or top-level http context):

client_header_buffer_size 16k;
large_client_header_buffers 4 16k;

Context

This is the console-image half of cozystack/cozystack#2853. The platform ingress-nginx controller is the other layer carrying the same oversized headers and is tracked there. Both layers need larger buffers for the fix to be complete.

Observed on Cozystack 1.3.5 / 1.4.2; confirmed the buffer directives are still absent on the current default branch.