Skip to content

fix: Remove obsolete warning about cookie-size #2012

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 1, 2025
Merged

fix: Remove obsolete warning about cookie-size #2012

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions V4_MIGRATION_GUIDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -235,9 +235,6 @@ If you'd like to customize the `user` object to include additional custom claims
## Additional changes

- By default, v4 is edge-compatible and as such there is no longer a `@auth0/nextjs-auth0/edge` export.
- Cookie chunking has been removed
- If the cookie size exceeds the browser limit of 4096 bytes, a warning will be logged
- To store large session data, please use a [custom data store](https://github.com/auth0/nextjs-auth0/tree/main?tab=readme-ov-file#database-sessions) with a SessionStore implementation
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also removing this from the migration guide, as this is no longer accurate in the latest version of v4.

- All cookies set by the SDK default to `SameSite=Lax`
- `touchSession` method was removed. The middleware enables rolling sessions by default and can be configured via the [session configuration](https://github.com/auth0/nextjs-auth0/tree/main?tab=readme-ov-file#session-configuration).
- `getAccessToken` can now be called in React Server Components.
Expand Down
12 changes: 0 additions & 12 deletions src/server/chunked-cookies.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,18 +190,6 @@ describe("Chunked Cookie Utils", () => {
expect(reqCookies.delete).toHaveBeenCalledWith(`${name}__4`);
});

it("should log a warning when cookie size exceeds warning threshold", () => {
const name = "warningCookie";
const options = { path: "/" } as CookieOptions;

// Create a value that exceeds the warning threshold (4096 bytes)
const value = "a".repeat(4097);

setChunkedCookie(name, value, options, reqCookies, resCookies);

expect(console.warn).toHaveBeenCalled();
});

describe("getChunkedCookie", () => {
it("should return undefined when cookie does not exist", () => {
const result = getChunkedCookie("nonexistent", reqCookies);
Expand Down
11 changes: 0 additions & 11 deletions src/server/cookies.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,6 @@ export { RequestCookies };
const MAX_CHUNK_SIZE = 3500; // Slightly under 4KB
const CHUNK_PREFIX = "__";
const CHUNK_INDEX_REGEX = new RegExp(`${CHUNK_PREFIX}(\\d+)$`);
const COOKIE_SIZE_WARNING_THRESHOLD = 4096;

/**
* Retrieves the index of a cookie based on its name.
Expand Down Expand Up @@ -171,8 +170,6 @@ const getAllChunkedCookies = (
* @param options - Options for setting the cookie.
* @param reqCookies - The request cookies object, used to enable read-after-write in the same request for middleware.
* @param resCookies - The response cookies object, used to set the cookies in the response.
*
* @throws {Error} If the cookie size exceeds the warning threshold.
*/
export function setChunkedCookie(
name: string,
Expand All @@ -183,14 +180,6 @@ export function setChunkedCookie(
): void {
const valueBytes = new TextEncoder().encode(value).length;

if (valueBytes > COOKIE_SIZE_WARNING_THRESHOLD) {
console.warn(
`The cookie size exceeds ${COOKIE_SIZE_WARNING_THRESHOLD} bytes, which may cause issues in some browsers. ` +
"Consider removing any unnecessary custom claims from the access token or the user profile. " +
"Alternatively, you can use a stateful session implementation to store the session data in a data store."
);
}

// If value fits in a single cookie, set it directly
if (valueBytes <= MAX_CHUNK_SIZE) {
resCookies.set(name, value, options);
Expand Down