{"record":{"id":"b4579fa1e1edc981","repo":"apache/druid","slug":"cookie-too-big-it-might-not-be-properly-set","errorCode":null,"errorMessage":"Cookie too big, it might not be properly set","messagePattern":"Cookie too big, it might not be properly set","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java","lineNumber":203,"sourceCode":"  {\n    if (context instanceof JEEContext) {\n      return delegate.renewSession(context);\n    }\n    return false;\n  }\n\n  @Nullable\n  private String compressEncryptBase64(final Object o)\n  {\n    if (o == null || \"\".equals(o)\n            || (o instanceof Map<?, ?> && ((Map<?, ?>) o).isEmpty())) {\n      return null;\n    } else {\n      byte[] bytes = serializeToBytes((Serializable) o);\n\n      bytes = compress(bytes);\n      if (bytes.length > 3000) {\n        LOGGER.warn(\"Cookie too big, it might not be properly set\");\n      }\n\n      return StringUtils.encodeBase64String(cryptoService.encrypt(bytes));\n    }\n  }\n\n  @Nullable\n  private Serializable uncompressDecryptBase64(final String v)\n  {\n    if (v != null && !v.isEmpty()) {\n      try {\n        byte[] bytes = StringUtils.decodeBase64String(v);\n        if (bytes != null) {\n          return deserializeFromBytes(uncompress(cryptoService.decrypt(bytes)));\n        }\n      }\n      catch (Exception e) {\n        LOGGER.debug(\"Failed to decrypt cookie value: %s\", e.getMessage());","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java#L185-L221","documentation":"In Pac4jSessionStore.compressEncryptBase64(), after serializing and compressing the profile object, if the compressed bytes exceed 3000 bytes the store warns that the resulting cookie may be too large for the browser/server to accept (browsers cap cookies around 4KB, and encryption adds overhead). The value is still returned and set, but it risks being rejected or truncated, breaking session/profile persistence.","triggerScenarios":"Storing a very large user profile (many claims/groups/roles) in the pac4j session cookie: compressEncryptBase64 produces >3000 compressed bytes, e.g. IdP tokens with hundreds of group memberships or deeply nested profile attributes.","commonSituations":"Identity providers returning large group/role claim sets (Active Directory group sprawl); storing whole JWT/profile payloads instead of a session reference; concatenating multiple profiles into one cookie.","solutions":["Reduce profile size: limit claims requested from the IdP (drop group/role bloat) or map/filter claims before storing.","Switch the pac4j session store from cookie-based to server-side session storage so profiles do not travel in cookies.","Store only essential identity attributes (sub, name, email) rather than the full token payload.","If unavoidable, verify the resulting cookie is actually accepted by the browser (<4KB total) and requests still succeed."],"exampleFix":"// before\n// IdP maps all AD groups (~200) into the profile -> compressed cookie >3000 bytes\n// after\n// IdP claim filter: send only role-relevant groups or a single 'roles' claim\n// map.put(\"groups\", filteredTopLevelRoles);","handlingStrategy":"validation","validationCode":"if (compressedProfileBytes.length > 3000) {\n  throw new IllegalArgumentException(\"profile too large for session cookie; trim claims\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Limit IdP claims (especially groups) to what authorization needs.","Prefer server-side session storage over cookie session stores for rich profiles.","Keep total Set-Cookie size under ~4KB; target <3000 compressed bytes.","Audit profile size after any IdP claim-mapping change."],"tags":["cookie","session","payload-size","pac4j","security"],"backgroundTag":"payload-too-large","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}