{"action":"created","issue":{"url":"https://api.github.com/repos/KentorIT/authservices/issues/594","repository_url":"https://api.github.com/repos/KentorIT/authservices","labels_url":"https://api.github.com/repos/KentorIT/authservices/issues/594/labels{/name}","comments_url":"https://api.github.com/repos/KentorIT/authservices/issues/594/comments","events_url":"https://api.github.com/repos/KentorIT/authservices/issues/594/events","html_url":"https://github.com/KentorIT/authservices/issues/594","id":190698092,"number":594,"title":"Multiple \"Kentor.\" cookies","user":{"login":"robinvanpoppel","id":5755736,"avatar_url":"https://avatars.githubusercontent.com/u/5755736?v=3","gravatar_id":"","url":"https://api.github.com/users/robinvanpoppel","html_url":"https://github.com/robinvanpoppel","followers_url":"https://api.github.com/users/robinvanpoppel/followers","following_url":"https://api.github.com/users/robinvanpoppel/following{/other_user}","gists_url":"https://api.github.com/users/robinvanpoppel/gists{/gist_id}","starred_url":"https://api.github.com/users/robinvanpoppel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robinvanpoppel/subscriptions","organizations_url":"https://api.github.com/users/robinvanpoppel/orgs","repos_url":"https://api.github.com/users/robinvanpoppel/repos","events_url":"https://api.github.com/users/robinvanpoppel/events{/privacy}","received_events_url":"https://api.github.com/users/robinvanpoppel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-11-21T12:07:16Z","updated_at":"2016-12-10T11:05:30Z","closed_at":null,"body":"In our current solution we give the user an option to raise his security level (stepup). The code sends an authnrequest and sets a cookie starting with \"Kentor\". This cookie will only be cleaned up when the user completes the stepup, or if the user closes the browser. This leads to HTTP 400 - Bad Request (Request Header too long) when the user sends a lot of cookies. Automatically expiring these cookies would reduce the chance of this happening. Is there a reason why the cookies don't have a (configurable) expiration?\r\n\r\nThe code below sets the cookie:\r\nhttps://github.com/KentorIT/authservices/blob/25a7ec8c1afeacfe681a19b5001da86f39d91cf6/Kentor.AuthServices.HttpModule/CommandResultHttpExtension.cs#L91-L96\r\n\r\nThanks in advance!"},"comment":{"url":"https://api.github.com/repos/KentorIT/authservices/issues/comments/266200415","html_url":"https://github.com/KentorIT/authservices/issues/594#issuecomment-266200415","issue_url":"https://api.github.com/repos/KentorIT/authservices/issues/594","id":266200415,"user":{"login":"robinvanpoppel","id":5755736,"avatar_url":"https://avatars.githubusercontent.com/u/5755736?v=3","gravatar_id":"","url":"https://api.github.com/users/robinvanpoppel","html_url":"https://github.com/robinvanpoppel","followers_url":"https://api.github.com/users/robinvanpoppel/followers","following_url":"https://api.github.com/users/robinvanpoppel/following{/other_user}","gists_url":"https://api.github.com/users/robinvanpoppel/gists{/gist_id}","starred_url":"https://api.github.com/users/robinvanpoppel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robinvanpoppel/subscriptions","organizations_url":"https://api.github.com/users/robinvanpoppel/orgs","repos_url":"https://api.github.com/users/robinvanpoppel/repos","events_url":"https://api.github.com/users/robinvanpoppel/events{/privacy}","received_events_url":"https://api.github.com/users/robinvanpoppel/received_events","type":"User","site_admin":false},"created_at":"2016-12-10T11:05:30Z","updated_at":"2016-12-10T11:05:30Z","body":"I agree that this is kind of an exotic condition. For now I've only heard back from a few cases. \r\n\r\nWe are running our site on a subdomain. The toplevel domain already sets a few cookies. IE en Edge have a different behavior than other browsers and also send the top level cookies to our subdomain. That combined with the large WIF-cookies, the loadbalancer cookies for sticky sessions it grows quite rapid. I did a quick test with just logging in in the system. In chrome I receive about 3000 bytes of cookies. In IE after visiting the main site first I have around 3900 bytes of cookies. That leaves little room.\r\n\r\nOn top of that I've experienced that not all browsers clear the session cookies upon closing. Chrome for instance does this when you check the option \"Continue where you left off\". "}}
{"actor":{"display_login":"robinvanpoppel"}}