Bug: Some session data got lost when trying to set session with big payload

[wallseat]

Bug: Some session data got lost when trying to set session with big payload

[wallseat]

Thx @peterschutt !

[peterschutt]

Thanks @wallseat - good find!

Once cookies get above a certain size, we chunk them and store across multiple cookies. When this happens, cookies get stored with an enumeration, e.g., session-0, session-1 etc.

In this case, the session is persisted in the headers for the first time when the request to /protected_route is redirected to the auth route. At this time, the session cookie is not greater than the chunk size and so it gets stored in the cookie under the name session.

After authentication, when the size of the session is much larger due to the presence of the tokens, the serialized session is greater than the chunk size, so the session cookie gets chunked and stored under session-0, session-1.

There is an issue with the algorithm that detects cookies that should be cleared under the condition where the cookie grows in size greater than a single chunk, and that is what we're hitting here. The original session cookie was not being cleared when it is superseded by a cookie called session-0.

[peterschutt]

@all-contributors add @wallseat for bug

[allcontributors]

@peterschutt

I've put up a pull request to add @wallseat! 🎉

[github-actions]

This issue has been closed in #3446. The change will be included in the upcoming patch release.

[github-actions]

A fix for this issue has been released in v2.8.3