Chunk long cookies

[jpolvto]

Splits the JWT token over multiple cookies if it's too big. Should resolve #1685. It's a bit hard to check, since my account doesn't have a large JWT token. @dokterbob

[fcestari]

@jpolvto, I have tested a few times with a large JWT token and I can confirm it has worked on my side.

[dokterbob]

Thanks for the quick contrib!

We'd love to get this in soon, but as this code will affect nearly all users we need to thread carefully.

In addition to the issues pointed out in the code, I'd love to see unit test coverage of cookie getting and setting. This includes a test for the specific bug pointed out! If you need help on approach to testing, DM me on Discord.

I would also suggest implementing this workaround (which is what it is!) such that the behaviour for typical tokens doesn't change. Plus a test that indeed it doesn't.

One way to do this:

• access_token_0 present -> look for _1 etc.
• access_token present -> cookie fits, no need to look for _1 etc.

When setting cookies, we need to check for chunked cookies and, if they exist, ensure cookies beyond what we're currently setting get deleted!

As a bonus, this will provide a clear distinction between chunked and non-chunked codepaths, making it easy to remove this once a more elegant/sane response than sending extra 4k+

[dokterbob]

I would suggest a clearer signature.

Something like get_token_from_cookies(cookies: dict[str, str]) -> Optional[str].

[dokterbob]

We should be careful here to ensure the case where we're overwriting cookies and not deleting old ones.

Imagine:

1. set_auth_cookie(r, 'incredibly_<...>_long_token') sets access_token_0, access_token_1.
2. set_auth_cookie(r, 'more_reasonable_token') sets only access_token_0.
3. get_token_from_cookies(🍪) returns the concatenation of the new access_token_0 and the old access_token_1.

[dokterbob]

See prior review. ;)

Forgot to set status properly.

[dokterbob]

@jpolvto Happy to see your applying requested changes!

If you need support writing tests, let me know. I've a bit of capacity available as this is blocking lot's of users.