Microsoft-authentication-library-for-js: 431 Request Header Fields Too Large due to msal long cookie send in headers

[AbhaysinghBhosale]

Please follow the issue template below. Failure to do so will result in a delay in answering your question.

Library

• [ ] [email protected]

Framework

React v16.6

Description

Due to loo long cookie send in request header azure webapp returning 431 error ie request headers field too large. After looking into the issues found that cookie send in the header is too long causing this issue.

cookie shown in request headers(in chrome network tab) contains a long info about msal as follows.
It contains msal login urls, client-info, nonce, authority and many other thing prefixed with msal.

I think cookie sent as header contain duplicate info about msal.....

Configuration

const config = {
      auth: {
        clientId: process.env.REACT_APP_EnterpriseADAppClientID,
        redirectUri: redirectUri,
        postLogoutRedirectUri : redirectUri
      },
      cache: {
        cacheLocation: "localStorage",
        storeAuthStateInCookie: true
      },
      system: {
        logger: logger,
        tokenRenewalOffsetSeconds: 300
      }
    }

Browsers

Chrome

[AbhaysinghBhosale]

@jasonnutter is there any workaround for this? or it will be fixed in any new version of msal ?

If this issues with long cookie is due to acquireTokenSilent which creating duplicate/long cookie. Because if its the reason i can disabled acquireTokenSilent calls.

[jasonnutter]

@AbhaysinghBhosale Not yet, we are planning to have a fix soon.

[AndreiZe]

This is serious issue because all requests going to app will be failing with the same 431 error. We fixed this in our case by specifying
cache: { storeAuthStateInCookie: false }
in MSAL configuration. We could do it because we do not support IE anymore and rely on localStorage for caching tokens.

[jasonnutter]

Closing as duplicate, tracked in #1188

[AbhaysinghBhosale]

Even after updating to latest version getting same issue, Cookie size in the request header is still the same