From c767e5c029610e27330969ffd580191a37434fbe Mon Sep 17 00:00:00 2001 From: damanpreetsingh Date: Mon, 5 Oct 2026 20:40:50 +0530 Subject: [PATCH] okta: stop storing raw tokens in the session cookie Logging in via Okta could fail on the callback with "500 - securecookie: the value is too long: 4128". The callback saved both the raw ID token and the raw access token in the gorilla/sessions cookie store. Okta ID tokens grow with the user's claims (notably a large groups claim), and once encrypted and base64 encoded the two tokens exceeded securecookie's default 4096 byte limit, so Save failed. Neither token is read after login: the ID token is verified once in the callback, and Ensure only checks that the session value is non-empty. Store a "verified" marker under the existing id_token key instead and drop the access token, which keeps the cookie small regardless of token size. Also delete the one-time nonce once it has been consumed. Existing sessions still authenticate (the key is unchanged and non-empty). Users who already hold an oversized cookie should clear cookies for the site once. --- http/okta/auth.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/http/okta/auth.go b/http/okta/auth.go index 46e479d..534b205 100644 --- a/http/okta/auth.go +++ b/http/okta/auth.go @@ -119,8 +119,11 @@ func (h *AuthHandler) AuthCodeCallbackHandler(w http.ResponseWriter, r *http.Req return } - session.Values["id_token"] = exchange.IDToken - session.Values["access_token"] = exchange.AccessToken + // The ID token has been verified above. Don't keep the raw tokens in the + // cookie: with a large groups claim they exceed securecookie's 4096 byte + // limit. Only a marker is needed to flag the session as authenticated. + session.Values[sessionIDTokenKey] = "verified" + delete(session.Values, "nonce") err = session.Save(r, w) if err != nil { h.errorWriter(w, r, err, http.StatusInternalServerError)