Oversize Cookie Alert

[bdwyertech]

Cookies cannot be larger than 4kb

It took me a long while to debug this, no one else should ever have to.

This issue showed face whilst attempting to add refresh_token support to the Azure provider, which uses pretty large tokens.

With all the padding and what not, I was hitting 4264 bytes, which was simply triggering the alert:
Cookie "oauth2_proxy" not present

[bdwyertech]

@thenewwazoo you might want to take this into consideration in your Azure implementation.

Even without any groups (like you've added to the cookie), the combination of access_token and refresh_token alone make the resulting cookie too large.

I've been dabbling with refresh_token support on my branch https://github.com/bdwyertech/oauth2_proxy/tree/bdwyertech

[thenewwazoo]

Yeah, exploding cookie size was something I expected given that there are instances when a user in our org can be a member of literally hundreds of groups. The various filtering mechanisms were an attempt to corral that. I haven't yet encountered a scenario where cookie sizes get too big without groups, but I also haven't been tracking their actual size.

I'm tempted to bust group information out into an entirely separate cookie.