Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"invalid cookie, longer than max length 4093" #2165

Closed
jaxxstorm opened this issue Aug 16, 2019 · 3 comments
Closed

"invalid cookie, longer than max length 4093" #2165

jaxxstorm opened this issue Aug 16, 2019 · 3 comments
Labels
bug Something isn't working security Security related workaround There's a workaround, might not be great, but exists

Comments

@jaxxstorm
Copy link

Describe the bug
The current size limit of the JWT token is 4093, which is prohibitive for orgs using SSO with large group memberships.

This seems to have been brought up in #1103 and was then closed with the fix being to display a warning. This doesn't really help those of us with large orgs trying to configure SSO that need to use dex

To Reproduce
Configure dex with an SSO provider with a large number of groups returned
Attempt to login

Expected behavior
User can login

Version
v1.1.2

@jaxxstorm jaxxstorm added the bug Something isn't working label Aug 16, 2019
@alexec
Copy link
Contributor

alexec commented Aug 16, 2019

This is a known issue.

You likely are part of many groups and have gone over the 4KB limit which is set for cookies.
You can get the list of groups by opening developer tools -> network
click log in
find the call to <argocd_instance>/auth/callback?code=<random_string>
You will see a cookie argocd.token
Take the cookie value check the length, you can use https://mothereff.in/byte-counter
You can decode the token at https://jwt.io/
That will provide the list of teams, that you can remove yourself from.

This will be mitigated by #2134, and by #1642.

@alexec alexec added the workaround There's a workaround, might not be great, but exists label Aug 16, 2019
@alexec
Copy link
Contributor

alexec commented Aug 23, 2019

See #1103

@alexec alexec added the security Security related label Aug 23, 2019
@alexec
Copy link
Contributor

alexec commented Nov 13, 2019

v1.3 contains a fix to mitigate this issue, by compressing the cookie. We don't plan to provide a complete fix for this at this time.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working security Security related workaround There's a workaround, might not be great, but exists
Projects
None yet
Development

No branches or pull requests

2 participants