Kratos logging out frequently

[wawhal]

I'm using Kratos (the docker image) v1.2.0 as my authn server. It sits behind my custom reverse proxy and talks to a postgres DB as its state store.

I'm able to login, register and make successful whoami requests well, just that it unexpectedly logs out. Kratos logs say that No session found. Copying the log below.

{
  "insertId": "e4r644v38xoi8jzl",
  "jsonPayload": {
    "service_version": "v1.2.0",
    "level": "info",
    "error": {
      "message": "request does not have a valid authentication session",
      "status": "Unauthorized",
      "stack_trace": "\ngithub.com/ory/kratos/session.(*ManagerHTTP).FetchFromRequest\n\t/project/session/manager_http.go:236\ngithub.com/ory/kratos/session.(*Handler).whoami\n\t/project/session/handler.go:215\ngithub.com/ory/kratos/x.(*RouterPublic).Handle.NoCacheHandle.func1\n\t/project/x/nocache.go:21\ngithub.com/julienschmidt/httprouter.(*Router).ServeHTTP\n\t/go/pkg/mod/github.com/julienschmidt/httprouter@v1.3.0/router.go:387\ngithub.com/ory/nosurf.(*CSRFHandler).handleSuccess\n\t/go/pkg/mod/github.com/ory/nosurf@v1.2.7/handler.go:234\ngithub.com/ory/nosurf.(*CSRFHandler).ServeHTTP\n\t/go/pkg/mod/github.com/ory/nosurf@v1.2.7/handler.go:185\ngithub.com/ory/kratos/cmd/daemon.servePublic.MaxBytesHandler.func4\n\t/usr/local/go/src/net/http/server.go:3841\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2166\ngithub.com/urfave/negroni.(*Negroni).UseHandler.Wrap.func1\n\t/go/pkg/mod/github.com/urfave/negroni@v1.0.0/negroni.go:46\ngithub.com/urfave/negroni.HandlerFunc.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/negroni@v1.0.0/negroni.go:29\ngithub.com/urfave/negroni.middleware.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/negroni@v1.0.0/negroni.go:38\ngithub.com/ory/kratos/x.init.func1\n\t/project/x/clean_url.go:15\ngithub.com/urfave/negroni.HandlerFunc.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/negroni@v1.0.0/negroni.go:29\ngithub.com/urfave/negroni.middleware.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/negroni@v1.0.0/negroni.go:38\ngithub.com/ory/kratos/cmd/daemon.servePublic.func1\n\t/project/cmd/daemon/serve.go:111\ngithub.com/urfave/negroni.HandlerFunc.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/negroni@v1.0.0/negroni.go:29\ngithub.com/urfave/negroni.middleware.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/negroni@v1.0.0/negroni.go:38\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2166\ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerResponseSize.func1\n\t/go/pkg/mod/github.com/prometheus/client_golang@v1.13.0/prometheus/promhttp/instrument_server.go:284\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2166\ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerCounter.func1\n\t/go/pkg/mod/github.com/prometheus/client_golang@v1.13.0/prometheus/promhttp/instrument_server.go:142\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2166\ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerDuration.func1\n\t/go/pkg/mod/github.com/prometheus/client_golang@v1.13.0/prometheus/promhttp/instrument_server.go:92\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2166\ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerDuration.func2\n\t/go/pkg/mod/github.com/prometheus/client_golang@v1.13.0/prometheus/promhttp/instrument_server.go:104\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2166\ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerRequestSize.func1\n\t/go/pkg/mod/github.com/prometheus/client_golang@v1.13.0/prometheus/promhttp/instrument_server.go:234\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2166\ngithub.com/ory/x/prometheusx.Metrics.Instrument.Metrics.instrumentHandlerStatusBucket.func1\n\t/go/pkg/mod/github.com/ory/x@v0.0.623/prometheusx/metrics.go:115\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2166\ngithub.com/ory/x/prometheusx.(*MetricsManager).ServeHTTP\n\t/go/pkg/mod/github.com/ory/x@v0.0.623/prometheusx/middleware.go:41\ngithub.com/urfave/negroni.middleware.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/negroni@v1.0.0/negroni.go:38",
      "debug": "",
      "reason": "No active session was found in this request.",
      "status_code": 401
    },
    "msg": "No valid session found.",
    "service_name": "Ory Kratos",
    "http_request": {
      "remote": "10.12.9.118:39756",
      "scheme": "http",
      "path": "/sessions/whoami",
      "host": "zamp-hcp-auth-auth:4433",
      "method": "GET",
      "headers": {
        "accept": "application/json",
        "user-agent": "OpenAPI-Generator/1.0.0/go",
        "accept-encoding": "gzip",
        "cookie": [
          "ory_kratos_continuity=MTcyNzA5MTE2N3xEWDhFQVFMX2dBQUJFQUVRQUFCZl80QUFBUVp6ZEhKcGJtY01Jd0FoYjNKNVgydHlZWFJ2YzE5dmFXUmpYMkYxZEdoZlkyOWtaVjl6WlhOemFXOXVCbk4wY21sdVp3d21BQ1F5WXpjeVpUZGtaQzA1TmpsaUxUUTRPVEV0T0dOa05pMWxaVEk0TXpWaU5HRXpPVEE9fKHzeDfD1mdNJ8mMKlBXNTHNt54_KiPC6bdu4AQCe7d9; csrf_token_2b968601d0229cdef1c5b77e5b0988a1c8e7f25635460c245bec7ffd440e296b=DKF+5rs/jDuvEZfaE74dNq29AO44pvYpj+ngC2blosc=; ory_kratos_session=MTcyNzA5NjM0M3xCVEdNZnY0R1VUNk11Q2FIWEZwd0t4MlJRa3ZRZUlyVnlSRDN5dGRyVExpa3lyWjB2S05Hb2E0Nk56ZnF4NVdsNFE1R0h5V2ZBOHdRcFNaUGdyNHFkQXBxMG1GWk9pYm5CV2xYUWUxYlZxWnpOaTRqZmp4QktqTl9qNDY3R3FUWWdUajBlU2JkVFJQbHU0RFZyQVE4S2tRUGw1NS0yRWM4RXl1dmc3clZ5c1VGMjdRTGRrY1FuRmdtNXhPX3hfeEVCclVBakNlSHBfZmZkY1BXTTNxVUU1Q2FaRGM2XzE4aldDRTZnTDdJQVF4RnhuM2hpVDZQUFdjdjlocmNmRDJ4WkxBYWxSQVFsS1hOcUdLUjNBQT18rEsLdq_203trGUoyEKiEcUfzxysn0xINb_N3jyA93Zo="
        ]
      },
      "query": null
    },
    "audience": "audit"
  }
  },
  "timestamp": "2024-09-23T13:36:41.350819012Z",
  "severity": "INFO",
  "receiveTimestamp": "2024-09-23T13:36:44.665392195Z"
}

Been struggling quite a bit on figuring out the root cause. Sometimes its logs me out in less than 10 minutes, even though the lifespan is set to 24h. Would really any pointers.

Pasting my kratos.yaml. Other variables are passed through environment variables:

version: v1.2.0

log:
  level: trace
  format: json
  leak_sensitive_values: true

identity:
  default_schema_id: default
  schemas:
    - id: default
      url: file:///home/ory/identity.schema.json

cookies:
  path: /
  same_site: Lax

session:
  lifespan: 24h


hashers:
  algorithm: bcrypt
  bcrypt:
    cost: 8

selfservice:
  flows:
    registration:
      after:
        oidc:
          hooks:
            - hook: session

  methods:
    oidc:
      enabled: true
    password:
      enabled: true

[vinckr]

Hello @wawhal

that is strange indeed! Maybe there is something triggering a logout flow in your frontend?

Can you maybe share steps to reproduce this with a clean Kratos quickstart?

[wawhal]

This surprisingly went away when I scaled up kratos vertically. Restarts due to horizontal scaling were causing this (although I don't know why yet).
I'll create a repo with my setup to reproduce this and share shortly.

[vinckr]

I see, that kinda makes sense. I can't promise I can spend much time on this, but feel free to create a reproducible repo, it would help for sure!