ring-clojure / ring-clojure/ring
Cookie session store fails silently, if the cookie data gets too large
Nobody has claimed this yet.
- Dominant language
- Clojure
- Stars
- 3.9k
- Forks
- 528
- PR merge metrics
- No merged PRs in 30d
Description
When I tried to take cookie-store into use, I noticed that it silently failed, not creating any cookie and without warning (either on the ring side, or on the Chrome side).
After some debugging and adding traces to ring code I found out that the cookie data size grew quite large, and that most likely caused the silent failure. In our case the root cause was debug data that got leaked into session, and issue got fixed by removing it.
It would be probably a good idea to log a warning or fail if the size of the encrypted cookie exceeds the maximum size, which is around 4kB I believe?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the cookie session store entry point and reproduce the case where encrypted cookie data exceeds the browser limit. Trace whether the oversized cookie is rejected on the Ring or Chrome side, then verify that the chosen warning or failure is observable when the size limit is exceeded.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- clojure
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100