Deal with 4KB cookie limit for JWT

[jessesuen]

It's possible for Argo CD's JWT auth token to be larger than 4KB, which is the maximum size of a HTTP cookie. This limitation was hit after configuring Dex's GitHub loadAllGroups flag to return the entire list of group claims for a user.

This issue is to find alternative means of dealing with the 4KB limit. Some options:

1. compress the JWT
2. use a traditional session ID and store actual JWT in redis
3. session storage

Note we should not use local storage. For reasons, see: https://dev.to/rdegges/please-stop-using-local-storage-1i04

[jessesuen]

Seems like this may provide the best experience (session tokens carried to other tabs) without compromising security:
https://blog.guya.net/2015/06/12/sharing-sessionstorage-between-tabs-for-secure-multi-tab-authentication/

@alexmt LMK your thoughts

[jessesuen]

Current JWT handling described here: https://github.com/argoproj/argo-cd/blob/master/docs/security.md

[alexec]

view-source:https://blog.guya.net/security/browser_session/memoryStorage.html

[alexec]

My investigation revealed that any option that works-around cookies would not work for EventSource. This is because EventSource does not allow you to modify headers. We need to do this to inject our large cookie.

Instead, we'll modify the application to display a clear error on large cookie.

[alexec]

Update - theres https://github.com/Yaffle/EventSource that will work I think.

[mauro-dellachiesa]

Is there a plan to fix this in any future release?
Thanks!

[professor-layton]

Hi, I also encounter the issue because of large claims acquired.
Appreciate to hear about a plan to fix it in future.
Thanks

[professor-layton]

Hi, I also encounter the issue because of large claims acquired.
Appreciate to hear about a plan to fix it in future.
Thanks

I found a way for filter the 'goups' to decrease the size of cookies:

in dex source code, there're all already some logic for groups filtering.
So I just add a list for 'groups' I prefer in the dex config, and then it works