apache/druid · warning

Cookie too big, it might not be properly set

Error message

Cookie too big, it might not be properly set

What it means

In Pac4jSessionStore.compressEncryptBase64(), after serializing and compressing the profile object, if the compressed bytes exceed 3000 bytes the store warns that the resulting cookie may be too large for the browser/server to accept (browsers cap cookies around 4KB, and encryption adds overhead). The value is still returned and set, but it risks being rejected or truncated, breaking session/profile persistence.

Solutions

1. Reduce profile size: limit claims requested from the IdP (drop group/role bloat) or map/filter claims before storing.
2. Switch the pac4j session store from cookie-based to server-side session storage so profiles do not travel in cookies.
3. Store only essential identity attributes (sub, name, email) rather than the full token payload.
4. If unavoidable, verify the resulting cookie is actually accepted by the browser (<4KB total) and requests still succeed.

Example fix

// before
// IdP maps all AD groups (~200) into the profile -> compressed cookie >3000 bytes
// after
// IdP claim filter: send only role-relevant groups or a single 'roles' claim
// map.put("groups", filteredTopLevelRoles);

if (compressedProfileBytes.length > 3000) {
  throw new IllegalArgumentException("profile too large for session cookie; trim claims");
}

When it happens

Trigger: Storing a very large user profile (many claims/groups/roles) in the pac4j session cookie: compressEncryptBase64 produces >3000 compressed bytes, e.g. IdP tokens with hundreds of group memberships or deeply nested profile attributes.

Common situations: Identity providers returning large group/role claim sets (Active Directory group sprawl); storing whole JWT/profile payloads instead of a session reference; concatenating multiple profiles into one cookie.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

• Setting authentication cookie over non-HTTPS connection…
• No profiles found after OIDC auth.
• Access-Check-Result
• <authResult.getErrorMessage()>
• authResult.getErrorMessage()

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/b4579fa1e1edc981. Report an issue: GitHub.

Appendix: source

Thrown at extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java:203

  {
    if (context instanceof JEEContext) {
      return delegate.renewSession(context);
    }
    return false;
  }

  @Nullable
  private String compressEncryptBase64(final Object o)
  {
    if (o == null || "".equals(o)
            || (o instanceof Map<?, ?> && ((Map<?, ?>) o).isEmpty())) {
      return null;
    } else {
      byte[] bytes = serializeToBytes((Serializable) o);

      bytes = compress(bytes);
      if (bytes.length > 3000) {
        LOGGER.warn("Cookie too big, it might not be properly set");
      }

      return StringUtils.encodeBase64String(cryptoService.encrypt(bytes));
    }
  }

  @Nullable
  private Serializable uncompressDecryptBase64(final String v)
  {
    if (v != null && !v.isEmpty()) {
      try {
        byte[] bytes = StringUtils.decodeBase64String(v);
        if (bytes != null) {
          return deserializeFromBytes(uncompress(cryptoService.decrypt(bytes)));
        }
      }
      catch (Exception e) {
        LOGGER.debug("Failed to decrypt cookie value: %s", e.getMessage());

View on GitHub (pinned to 9b90983fd2)