@@ -427,12 +427,47 @@ server {
427427 auth_request_set $auth_cookie $upstream_http_set_cookie;
428428 add_header Set-Cookie $auth_cookie;
429429
430+ # When using the --set-authorization flag, some provider's cookies can exceed the 4kb
431+ # limit and so the OAuth2 Proxy splits these into multiple parts.
432+ # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
433+ # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
434+ auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;
435+
436+ # Extract the Cookie attributes from the first Set-Cookie header and append them
437+ # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
438+ if ($auth_cookie ~* "(; .*)") {
439+ set $auth_cookie_name_0 $auth_cookie;
440+ set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
441+ }
442+
443+ # Send both Set-Cookie headers now if there was a second part
444+ if ($auth_cookie_name_upstream_1) {
445+ add_header Set-Cookie $auth_cookie_name_0;
446+ add_header Set-Cookie $auth_cookie_name_1;
447+ }
448+
430449 proxy_pass http://backend/;
431450 # or "root /path/to/site;" or "fastcgi_pass ..." etc
432451 }
433452}
434453```
435454
455+If you use ingress-nginx in Kubernetes (which includes the Lua module), you also can use the following configuration snippet for your Ingress:
456+
457+```yaml
458+nginx.ingress.kubernetes.io/auth-response-headers: Authorization
459+nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$request_uri
460+nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
461+nginx.ingress.kubernetes.io/configuration-snippet: |
462+ auth_request_set $name_upstream_1 $upstream_cookie_name_1;
463+
464+ access_by_lua_block {
465+ if ngx.var.name_upstream_1 ~= "" then
466+ ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
467+ end
468+ }
469+```
470+
436471## Contributing
437472
438473Please see our [Contributing](CONTRIBUTING.md) guidelines.