Session ID or Cookie is Renewed or Cleared with External Authentication

[mxhash]

Describe the bug

When using Icinga Web 2 with external authentication via mod_auth_openidc, the session ID is renewed on every (or some) request. This behavior can lead to issues with CSRF token validation in other modules, such as the Director. The continuous renewal of session IDs prevents consistent validation of CSRF tokens, causing validation to fail and potentially disrupting functionality. However, Icinga Web forms, such as those for comments and downtimes, work without any issues

To Reproduce

Assuming Icinga Web 2 is configured with external authentication and the Director module is enabled, editing any entity in the Director will result in an exception due to CSRF token validation failure.

Expected behavior

Ensure forms are submitted without validation failures, especially in the Director module.

Screenshots

Screen.Recording.2024-06-11.at.14.25.26.mov

Take a look at the Icinga Web 2 cookie, which disappears on reload. This issue does not occur in the IcingaDB module.

Your Environment

Include as many relevant details about the environment you experienced the problem in

• Icinga Web 2 version and modules (System - About): 2.12.1
• Web browser used: Arc (Chrome Based)
• Icinga 2 version used (icinga2 --version): r2.14.2-1
• PHP version used (php --version): 7.4.3-4ubuntu2.22
• Server operating system and version: 20.04.6 LTS (Focal Fossa)

Additional context

I am not sure if this issue is only related to the Director; it sometimes happens in the system views too.