Too long strings in user_metadata causing authentication to break

The payload names no implementation files; start at the auth.admin.updateUserById flow and the SSR cookie handling described in the report. Reproduce with short and long user_metadata values, compare the resulting access_token cookies, and check discussion #9972 for related behavior; done should mean the failure is understood and malformed cookies or a silent authentication break are addressed.

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

We've encountered an unexpected behavior when updating user_metadata using the supabase.auth.admin.updateUserById method. It appears that there's an undocumented length limitation on the values stored in user_metadata. When this limit is exceeded, it causes authentication to break in an unclear manner and results in multiple, malformed cookies being set.

It's not per key-value pair, it's the accumulated length of the meta_data. A bunch of short key-value pairs results in the same behavior.

We are using the SSR package with the name in the cookieOptions set to access_token.

// This works fine
await supabase.auth.admin.updateUserById("user-id-here", {
  user_metadata: {
    images: "short string",
  },
})

// This breaks authentication
await supabase.auth.admin.updateUserById("user-id-here", {
  user_metadata: {
    images: "long string long string long string long string long string long string long string long string long string long string long string long string long string long string long string long string long string long string long string long string long string long string long string long string long string long string long string long string",
  },
})

When the value exceeds a certain undocumented length, the following issues occur:

1. The update appears to succeed but actually breaks the user's authentication.
2. Multiple cookies are set with incorrect names (e.g., "access_token.0", "access_token.1").
3. The content of these cookies is malformed:

• The first cookie starts with "base64-" as expected, but is truncated.
• The second cookie does not start with "base64-" and appears to be a fragment of a base64 encoded string.

4. These issues manifest as problems with the access token, causing the user to be unable to log in or use the application again.

To Reproduce

1. Use the supabase.auth.admin.updateUserById method to update a user's metadata.
2. Set a value in the user_metadata object with a shorter string.
3. Observe that the update succeeds.
4. Now, try to update the same field with a longer string. I haven't found the exact length.
5. Observe that this causes the authentication to break without a clear error message.
6. Check the cookies set by the application and observe multiple, incorrectly named and malformed cookies.

Expected behavior

A clear and concise description of what you expected to happen.

Additional context

This issue seems to be related to the discussion in #9972, where similar unexpected behavior with user_metadata was reported. However, our case specifically highlights a potential length limitation and cookie malformation that wasn't mentioned in that discussion.