Change in behavior between :2 and :nightly container builds when http monitoring an OIDC protected url #8168

📑 I have found these related issues/pull requests

Not seeing anything in issues submitted likely due to it only being in the nightly build.

🛡️ Security Policy

• I have read and agree to Uptime Kuma's Security Policy.

📝 Description

Tried out nightly build to look over the new API endpoints. Noticed that this build introduces a change in behavior with monitoring https endpoints that redirect to an OIDC auth provider. After the switch, they start failing at about 5 minute intervals - from my web server logs, it looks like the monitor is accumulating cookies from partial authentication attempts or similar, but was not doing that previously.

This feels like "it became session aware and persistent" after the update, and that persistence is hanging onto acculating oidc session attempts, which then eventually get rejected for size by mod_auth_openidc.

I can work around by changing my monitors to hit an endpoint path that doesn't do the auth redirect - i.e. a health/ping endpoint, but this is an unexpected change in behavior.

👟 Reproduction steps

https monitor against a URL protected with mod_auth_openidc on apache, with a 30 second interval, it appears to start failing around every 5 minutes for a few minutes and then toggles back to green.

👀 Expected behavior

Normal monitoring behavior.

😓 Actual Behavior

Failing for a 1-2 minutes on a 5 minute cycle or close to it.

🐻 Uptime-Kuma Version

2.5.11 vs nightly

💻 Operating System and Arch

Docker on debian 13

🌐 Browser

Chrome current

🖥️ Deployment Environment

• Runtime Environment:
  • Docker: Version 29.9.3
  • MariaDB: Version 11.8 docker (LTS: Yes/No)
• Database:
  • MariaDB: External
• Database Storage:
  • Filesystem: ext4
  • Storage Medium: SSD
• Uptime Kuma Setup:
  • Number of monitors: ~40

📝 Relevant log output

Nothing useful other than some internal failures on notifications that are unrelated - it just shows the state transitions. 


[Fri Nov 13 14:49:36.203953 2026] [auth_openidc:warn] [pid 1557820:tid 1557820] [client 192.168.125.28:35660] oidc_state_cookies_clean_expired: state (mod_auth_openidc_state_iST5QefLO8fBHTMPr4D14iGEZSg) has expired (original_url=https://home.domain.com/path)

Note that the cookie being received is sent with a Expires=...1970 date - so it shouldn't persist beyond a single session.