Session cookies too big

[danecsvk]

I was using latest version of flask-oidc in combination with Superset and Keycloak. Created session cookie contains basically everything returned from Keycloak and it's really close to 4kB. Problem is when user has more attributes in Keycloak (such as groups, etc.), then there is possibility that session cookie will be bigger than 4kB and browser will not process it (as the limit for cookies is 4kB), you cannot login because of it.

I solved the issue by downgrading flask-oidc to v1.3.0. This version creates only small session cookie (around 300 bytes, containing just flask information) and separete oidc_id_token cookie (around 1kB). I found it out completely random 😀

Example session cookie content:

{
    "_fresh": true,
    "_id": "e4bc..",
    "_user_id": "2",
    "csrf_token": "b18..",
    "locale": "en",
    "oidc_auth_profile": {
        "adgroups": [
            "veduci"
        ],
        "departmentNumber": "..",
        "dn": "C..",
        "email": "po..",
        "email_verified": true,
        "family_name": "Pob..",
        "given_name": "Ve..",
        "locale": "sk",
        "name": "Ve..",
        "preferred_username": "po..",
        "sub": "78.."
    },
    "oidc_auth_token": {
        "access_token": "eyJh..",
        "expires_at": 1700040523,
        "expires_in": 1800,
        "id_token": "eyJ..",
        "not-before-policy": 0,
        "refresh_expires_in": 1800,
        "refresh_token": "eyJhb...",
        "scope": "openid profile email",
        "session_state": "92..",
        "token_type": "Bearer",
        "userinfo": {
            "adgroups": [
                "veduci"
            ],
            "at_hash": "gvj..",
            "aud": "pm..",
            "auth_time": 1700038751,
            "azp": "pm..",
            "departmentNumber": "O..",
            "dn": "C...",
            "email": "po...",
            "email_verified": true,
            "exp": 1700040552,
            "family_name": "Po..",
            "given_name": "Ve...",
            "iat": 1700038752,
            "iss": "https://...",
            "jti": "2be...",
            "locale": "sk",
            "name": "Ven..",
            "nonce": "p0...",
            "preferred_username": "po...",
            "session_state": "92...",
            "sid": "925...",
            "sub": "780...",
            "typ": "ID"
        }
    }
}

[kwalter94]

I was facing the same issue, resolved it by switching to server side sessions. Used the following configuration:

SESSION_SERVER_SIDE = True
SESSION_TYPE = "redis"
SESSION_REDIS = Redis.from_url("redis://redis:6379/0")
SESSION_USE_SIGNER = True