lws-login: log why the status probe found no usable JWT

A browser showing the "Not logged in" widget on a device that cannot be
inspected (an Android tablet) is undiagnosable today: the status endpoint
silently answers logged_in:0 and nothing on the server says what the
request actually carried.

lws_jwt_auth_create() only ever consults the first cookie of the configured
name, but browsers legitimately hold several same-named cookies at once
(host-only alongside Domain=, or leftovers minted under an earlier
cookie-domain config), ordered oldest-first per RFC 6265.  A stale first
cookie then shadows a live one behind it, and since every renewal and login
re-mints the other scope, the widget stays "Not logged in" until the stale
one ages out.  Meanwhile lws-login mints its renewed cookie with Max-Age
jwt-validity-secs (24h default) although the JWT inside expires on the auth
server's schedule, so such a stale cookie can outlive its JWT by a day.

When the .lws-login-status probe finds no usable JWT, walk every same-named
cookie with lws_http_cookie_get_nth(), verify each against jwt-jwk and log
at notice, attributed to the wsi: no Cookie header at all; no cookie of our
name (listing the names and value lengths that were sent); per cookie,
signature failure, or sub and live / expired-for-how-long; and an explicit
callout when more than one same-named cookie was presented.  Only the status
probe emits this, since it is the one request a not-logged-in widget always
makes and scanners never do.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: lws-team

plugins/protocol_lws_login/protocol_lws_login.c

@@ -1278,6 +1278,139 @@ simple_response(struct lws *wsi, struct pss_login *pss, const char *msg, const c
 	return 0;
 }
 
+
+/*
+ * Explain, at notice level, why this request did not yield a usable JWT in
+ * terms of what the browser actually presented.  Only emitted for the
+ * widget's .lws-login-status probe: that is the one request a "Not logged
+ * in" widget always makes, and bots scanning the mount never do, so it
+ * cannot become log spam.
+ *
+ * lws_jwt_auth_create() only ever looks at the FIRST cookie of the configured
+ * name, but browsers legitimately hold several same-named cookies at once
+ * (host-only alongside Domain=, or leftovers minted under an earlier
+ * cookie-domain config), ordered oldest-first per RFC 6265, so a stale value
+ * can shadow a live one sitting behind it in the same Cookie header.  Walk
+ * every occurrence and verify each against our JWK, so the log says which of
+ * "no cookie", "signature does not verify", "expired" or "shadowed by a
+ * stale duplicate" applies.  None of that is observable on the device (eg a
+ * tablet), and without it the not-logged-in widget is undiagnosable.
+ */
+static void
+lws_login_diag_jar(struct lws *wsi, struct vhd_login *vhd)
+{
+	uint64_t now = (uint64_t)lws_now_secs();
+	int n = 0, ck_len, expired = 0;
+
+	ck_len = lws_hdr_total_length(wsi, WSI_TOKEN_HTTP_COOKIE);
+	if (ck_len <= 0) {
+		lwsl_wsi_notice(wsi, "status probe: no JWT: request carries no "
+				     "Cookie header at all");
+		return;
+	}
+
+	for (;;) {
+		char jwt[8192], temp[2048], out[2048], sub[64];
+		size_t jwt_len = sizeof(jwt), out_len = sizeof(out), alen;
+		const char *v;
+		uint64_t exp = 0;
+
+		if (lws_http_cookie_get_nth(wsi, vhd->cookie_name, n, jwt,
+					    &jwt_len)) {
+			if (n)
+				break;
+
+			/*
+			 * No cookie of our name at all: say which names the
+			 * browser did send (names and value lengths only, the
+			 * values may be credentials for something else)
+			 */
+			{
+				char names[512], *ck, *q, *e;
+				int nl = 0;
+
+				ck = malloc((size_t)ck_len + 1);
+				if (!ck)
+					return;
+				if (lws_hdr_copy(wsi, ck, ck_len + 1,
+						 WSI_TOKEN_HTTP_COOKIE) <= 0) {
+					free(ck);
+					return;
+				}
+				names[0] = '\0';
+				q = ck;
+				while (q && *q) {
+					while (*q == ' ' || *q == ';')
+						q++;
+					e = strchr(q, ';');
+					if (e)
+						*e++ = '\0';
+					v = strchr(q, '=');
+					if (*q)
+						nl += lws_snprintf(names + nl,
+							sizeof(names) - (size_t)nl,
+							"%s%.*s(%d)", nl ? ", " : "",
+							v ? (int)(v - q) : (int)strlen(q),
+							q, v ? (int)strlen(v + 1) : 0);
+					q = e;
+					if ((size_t)nl >= sizeof(names) - 8)
+						break;
+				}
+				free(ck);
+				lwsl_wsi_notice(wsi, "status probe: no JWT: no "
+					"'%s' cookie in a %d-byte Cookie header "
+					"(cookies presented: %s)",
+					vhd->cookie_name, ck_len, names);
+			}
+			return;
+		}
+
+		if (lws_jwt_signed_validate(lws_get_context(wsi), &vhd->jwk,
+			"ES256,ES384,ES512,RS256,RS384,RS512,HS256", jwt,
+			jwt_len, temp, sizeof(temp), out, &out_len)) {
+			lwsl_wsi_notice(wsi, "status probe: '%s' cookie #%d "
+				"(%u bytes): signature does not verify against "
+				"jwt-jwk", vhd->cookie_name, n,
+				(unsigned int)jwt_len);
+			n++;
+			continue;
+		}
+
+		v = lws_json_simple_find(out, out_len, "\"exp\":", &alen);
+		if (v)
+			exp = (uint64_t)atoll(v);
+		sub[0] = '\0';
+		v = lws_json_simple_find(out, out_len, "\"sub\":", &alen);
+		if (v)
+			lws_strnncpy(sub, v, alen, sizeof(sub));
+
+		if (!exp || exp <= now) {
+			expired++;
+			lwsl_wsi_notice(wsi, "status probe: '%s' cookie #%d: "
+				"sub '%s' EXPIRED %llus ago (exp %llu)",
+				vhd->cookie_name, n, sub,
+				(unsigned long long)(exp ? now - exp : 0),
+				(unsigned long long)exp);
+		} else
+			lwsl_wsi_notice(wsi, "status probe: '%s' cookie #%d: "
+				"sub '%s' live for another %llus",
+				vhd->cookie_name, n, sub,
+				(unsigned long long)(exp - now));
+		n++;
+	}
+
+	if (n > 1)
+		lwsl_wsi_notice(wsi, "status probe: %d same-named '%s' cookies "
+			"presented but only #0 is ever consulted: a stale #0 "
+			"shadows any live one behind it (host-only vs Domain= "
+			"scope, or a leftover from an earlier cookie-domain "
+			"config)", n, vhd->cookie_name);
+	else if (expired)
+		lwsl_wsi_notice(wsi, "status probe: single expired '%s' JWT, "
+			"expect the widget's silent renewal to re-mint it next",
+			vhd->cookie_name);
+}
+
 /*
  * A "global admin" is solely the holder of the "*" wildcard grant -- the
  * established "god" grant, the TOFU bootstrap account that can manage every
@@ -1922,6 +2055,9 @@ callback_lws_login(struct lws *wsi, enum lws_callback_reasons reason,
 			}
 		}
 
+		if (!pss->ja && lws_login_ends_with(path, "/.lws-login-status"))
+			lws_login_diag_jar(wsi, vhd);
+
 		if (pss->ja) {
 			int level = lws_jwt_auth_query_grant(pss->ja, service_name);
 			if (level >= vhd->min_grant_level) {

plugins/protocol_lws_login/protocol_lws_login.md

@@ -213,3 +213,27 @@ expired, 1 not in db, 0 live` — browsers legitimately hold several
 `auth_refresh_session` values at once, ordered oldest-first, so resolution
 walks them all rather than trusting the first).  CSRF double-submit failures
 log which half was missing and the lengths, never the values themselves.
+
+### Status probe diagnostics
+
+A "Not logged in" widget on a device you cannot inspect (a tablet, a phone)
+is otherwise a dead end: the only thing that decides that state is the JWT
+cookie the browser presented, and the browser will not show you it.  So when
+the widget's `.lws-login-status` probe finds no usable JWT, the bouncer logs
+at `notice` exactly what the request carried, attributed to the wsi:
+
+ - no `Cookie` header at all, or none of the configured `cookie-name`
+   (listing the cookie names and value lengths that *were* sent);
+ - for **every** same-named cookie in the header, whether its signature
+   verifies against `jwt-jwk`, and if so its `sub` and whether it is live or
+   how long ago it expired.
+
+The second point matters because `lws_jwt_auth_create()` only ever consults
+the first cookie of that name, while browsers legitimately hold several at
+once (host-only alongside `Domain=`, or leftovers minted under an earlier
+`cookie-domain` config) ordered oldest-first, so a stale first cookie can
+shadow a live one behind it: every renewal and login re-mints the *other*
+scope and the widget stays "Not logged in" until the stale one ages out.
+The probe log calls that case out explicitly.  Only the status probe emits
+these lines, since it is the one request a not-logged-in widget always makes
+and scanners never do.