Nextjs-auth0: Malformed Response Cookie

[RyGuyM]

Description

Setting the a0:session cookie fails in Chrome with the error Malformed Response Cookie. This is due to the size of the cookie being greater than the allowed 4096 bytes. I'm not sure there is anything particularly special about our use case, it is only slightly extended from the default.

Reproduction

To reproduce there needs to be enough data in the user, idToken, and accessToken to overflow the cookie size limit.

• add additional scopes: 'openid profile email some_custom_internal_scope_a some_custom_internal_scope_b some_custom_internal_scope_c some_custom_internal_scope_d some_custom_internal_scope_e', may require more to trigger depending on user data
• add additional metadata to the user in auth0 dashboard: we have user_name (string) and email_signup (boolean) included
• include storeIdToken: true and storeAccessToken: true

Environment

• Library version: v0.10.0
• NextJS version: v9.3.1
• MacOS v10.15.3, Chrome v80

[RyGuyM]

I know this would add additional complexity to the library but would there be any willingness to accept a PR that splits the session into multiple cookies?

[balazsorban44]

I came to the same conclusion here https://github.com/auth0/nextjs-auth0/issues/69#issuecomment-576319469 but did not pursue a solution.

[sandrinodimattia]

I think sending a PR that is able to split the session into multiple cookies is fine (Microsoft's ASP.NET does this), however we'll need to consider the impact on Safari which has domain level limits (so you can't keep adding things forever).

[onethread]

I'm running into this issue as well with a pretty vanilla setup. RBAC on the API is enabled, so the access token is filled with a large list of permissions, which pushes the token size way up, and therefore the cookie size as well.

Any ideas? I'm not able to deactivate RBAC (it's being used by other projects). Looking at the code, it looks like cookies are mandatory, so I assume I'd have to switch to auth0.js.

[Widcket]

Hi everyone, this is now fixed in the v1.0.0-beta.0 release, which uses cookie stitching so large cookies should no longer cause issues.