auth-token cookie exceeds 4096 bytes and is rejected by Chrome

Open
#1,160 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
azure, go, javascript
Domain
authentication, backend

Research direction

Start by reproducing the PKCE flow with Azure and the additional calendar scopes, then inspect where the auth-token cookie is created and rejected. Done means the cookie stays within the 4096-byte browser limit and the session remains set in production as well as locally.

Written by the indexing model from the issue text.

Description

bug

Bug report

  • I confirm this is a bug with Supabase, not with my own application.
  • I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Using the PKCE flow, under certain conditions the auth-token (JWT) returned by Azure causes the total cookie size to exceed the 4096-byte limit, so it is rejected by the browser. This causes the session not to be set and the user is signed out.

For me, this only happens in production when adding extra scopes. On localhost, because the cookie name sb-localhost-auth-token is less characters, the cookie just fits (4094 bytes).

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

(I realize these steps involve a closed-source deployment. I can develop a minimal, open-source reproduction in the future if needed.)

  1. Go to divvy.day and sign in. Only common, non-sensitive scopes are requested and the PKCE works well.
  2. Authorize calendar read access, which adds two scopes.
  3. This time, using the same PKCE flow (which works in development) the cookie is too large which results in the user being signed out.

Expected behavior

The auth-token cookie must be kept within the limit so it is set.

Screenshots

Screenshot 2023-06-28 at 11 40 40 AM

(Yes, I understand the risk of sharing auth tokens. This is only a fraction of the token.)

Screenshot 2023-06-28 at 11 41 27 AM

System information

  • OS: macOS
  • Browser: Chrome
  • Version of supabase-js: 2.26.0
  • Version of @supabase/auth-helpers-remix: 0.2.1
  • Running on Cloudflare Pages
Dominant language
Go
Stars
2.6k
Forks
764
Avg merge
5d 3h
Merged PRs (30d)
39

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from supabase/auth

All issues in supabase/auth

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.