Chunk the Nuxt session cookie instead of trimming its payload - #74
Chunk the Nuxt session cookie instead of trimming its payload#74janithjay wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthroughNuxt now stores oversized session tokens across numbered cookies. Session reads, refreshes, and sign-out operations use chunked-cookie utilities. Unit tests cover writing, reading, stale-cookie cleanup, deletion, and token refresh behavior. ChangesChunked session cookies
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant issueSessionCookie
participant setChunkedCookie
participant BrowserCookies
participant getChunkedCookie
participant useServerSession
issueSessionCookie->>setChunkedCookie: Write session token
setChunkedCookie->>BrowserCookies: Set base or numbered cookies
BrowserCookies->>getChunkedCookie: Provide request cookies
getChunkedCookie->>useServerSession: Return session token
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
packages/nuxt/src/runtime/server/routes/auth/session/signout.post.tsESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox. packages/nuxt/src/runtime/server/utils/chunkedCookie.tsESLint skipped: the ESLint configuration for this file references a package that is not available in the sandbox. packages/nuxt/src/runtime/server/utils/serverSession.tsESLint skipped: the ESLint configuration for this file references a package that is not available in the sandbox.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/nuxt/src/runtime/server/utils/chunkedCookie.ts`:
- Around line 33-37: Update findExistingCookieNames to match the base cookie
name and only names with a decimal numeric suffix after `${name}.`; exclude
prefixed cookies such as `${name}.metadata` from the returned cleanup list.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 1fdf493e-1ea9-4904-9393-3e6e5b282198
📒 Files selected for processing (7)
packages/nuxt/src/runtime/server/routes/auth/session/signout.post.tspackages/nuxt/src/runtime/server/utils/chunkedCookie.tspackages/nuxt/src/runtime/server/utils/serverSession.tspackages/nuxt/src/runtime/server/utils/session.tspackages/nuxt/src/runtime/server/utils/token-refresh.tspackages/nuxt/tests/unit/chunked-cookie.test.tspackages/nuxt/tests/unit/token-refresh.test.ts
…ding 4KB browser limits Signed-off-by: janithjay <janithjayashan018@gmail.com>
4dba7b8 to
03a99bf
Compare
Purpose
The Nuxt quickstart's redirect-flow sign-in silently fails: the OAuth exchange completes successfully end-to-end (confirmed via backend logs - authorize, credential submission, code exchange, and JWKS fetch all return 200/302 as expected), but the user is bounced back to a signed-out state instead of landing on the authenticated page.
Root cause: createSessionToken (packages/nuxt/src/runtime/server/utils/session.ts) embedded the full access token, ID token, and refresh token - all JWTs themselves - as fields inside the session cookie's own JWT payload. With ThunderID's token claim set, the resulting cookie value routinely exceeds the browser's hard ~4096-byte per-cookie limit. The browser silently drops any Set-Cookie over that limit (confirmed in Chrome DevTools under "Malformed Response Cookies"), so the session is never actually established despite the server doing everything correctly.
Approach
Rather than trimming the payload, this changes splits the session cookie across numbered
name.0,name.1, ... chunk cookies once it would exceed the per-cookie limit, and reassembles them transparently on read. The approach suggested in review #69 (comment), modeled on next-auth's own session cookie chunking.idTokenis not removed - unlike the alternative fix in #69, this branch keeps the full session payload (accessToken+idToken+refreshToken) intact.Chunking absorbs the size instead of reducing it, so
useServerSession()'ssession.idTokenkeeps working exactly as it did before the bug was ever introduced.New
chunkedCookie.tsutility (getChunkedCookie/setChunkedCookie/deleteChunkedCookie) wired into all 5 session-cookie touchpoints: issuance (session.ts), token refresh (token-refresh.ts), the two session reads (serverSession.ts), and sign-out (signout.post.ts).The temp session cookie is untouched, it's always small and never needs chunking.
After the fix how __thunderid__session cookie was accepted
Related Issues
Related PRs
Checklist
breaking changelabel added.Security checks
Summary by CodeRabbit
New Features
Bug Fixes
Tests