Skip to content

Cap parallel OIDC login state cookies#1238

Merged
lovasoa merged 4 commits intomainfrom
fix-oidc-state-cookie-cap
Mar 12, 2026
Merged

Cap parallel OIDC login state cookies#1238
lovasoa merged 4 commits intomainfrom
fix-oidc-state-cookie-cap

Conversation

@lovasoa
Copy link
Collaborator

@lovasoa lovasoa commented Mar 11, 2026

Summary

Cap temporary sqlpage_oidc_state_* cookies to avoid unbounded cookie header growth during repeated or concurrent OIDC login attempts.

Changes

  • add a small cap for parallel OIDC login state cookies
  • evict only the excess temporary state cookies before creating a new login flow
  • add a focused unit test for the eviction boundary

Validation

  • cargo fmt --all
  • cargo test
  • cargo clippy --all-targets --all-features -- -D warnings

@lovasoa lovasoa linked an issue Mar 11, 2026 that may be closed by this pull request
@lovasoa lovasoa force-pushed the fix-oidc-state-cookie-cap branch from 17a21ad to 3dfa8b5 Compare March 12, 2026 10:24
@lovasoa lovasoa merged commit acb1893 into main Mar 12, 2026
14 checks passed
@lovasoa lovasoa deleted the fix-oidc-state-cookie-cap branch March 12, 2026 10:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

OIDC state cookies accumulate and can exceed proxy header limits

1 participant