Pomerium: internal/sessions: handle extremely large sessions (e.g. Azure)

[desimone]

Describe the bug
Some providers, such as azure, return _very_ large access and id tokens. This can cause an issue if the compressed, and encrypted pomerium cookie then exceeds 4096 bytes (supported by all browsers).

This can cause a redirect loop in pomerium because the cookie will fail to set, and restart the auth process.

To Reproduce:

https://thumbs.gfycat.com/VelvetyTintedIndianpalmsquirrel-mobile.mp4

Expected behavior

Pomerium should detect and handle large cookies.

Environment:

• Pomerium version (retrieve with pomerium --version): v0.0.5-dirty+d16978b
• Server Operating System/Architecture/Cloud: Currently only experienced with Azure.

Additional context

Azure in particular (ab)uses access_tokens to store a bunch of duplicated identity data.

See:

• #209
• #210

[sbilly]

I have same issue. Pomerium returns error 500.

• Pomerium version (retrieve with pomerium --version): v0.0.5+28efa33
• Server Operating System/Architecture/Cloud: Ubuntu 16.04 + Azure

[desimone]

Hi @sbilly !
Sorry about this. Unfortunately this is a known issue with Azure right now which typically returns very, very large session cookies. I'm curious, are you seeing this on every login, or do some of the requests successfully authenticate if you try enough times?

In my particular case, my session tends to be very close to the 4096 byte cutoff so about 75% of my login attempts work.

[sbilly]

I have tried 10 times.
It failed with the HTTP-500 error every time, and could not login at all.

[desimone]

Hi @sbilly -- thanks for trying. We are going to have to implement a session chunking strategy to fix this for Azure.