support for chunked cookies

[zandbelt]

Using the default cookie storage it may happen that the size of the cookie runs over browser limits when a lot of data is stored in the session. Adding support for chunked cookies would mitigate this somewhat. See: zmartzone/lua-resty-openidc#33

[bungle]

@zandbelt, Thanks. I saw that report. We should consider adding this support to lua-resty-session. Do you happen to know if there is any "standard" of how this should be handled?

[zandbelt]

I don't think there's a real standard; it doesn't really need one because its all "internal"; the process would be:

1. determine that the cookie size is too large to put in a single cookie (e.g. size > MAX bytes)
2. determine the number of cookies that should be used (e.g. n = size / MAX)
3. write a cookie that contains the number of chunks (e.g. Set-Cookie: session_number=)
4. write the cookies that contain the content (e.g. Set-Cookie: session_1=..., Set-Cookie: session_2=..., Set-Cookie: session_=...)

On retrieval one would check whether a cookie named session_number exists and would try read that many cookies whilst concatenating the content, otherwise fallback to the current behavior.

For an idea of the effort, see:
OpenIDC/mod_auth_openidc@5b6bb06

There's still a limitation in the maximum size of the (single) "Cookie" header that the browser will actually manage to send, but that is known to be much larger (typically at least 81920), see:
http://browsercookielimits.squawky.net/

[bungle]

Okay. I can think about implementing this. Thank you. I already started looking at it.

[bungle]

@zandbelt,

The first try to do this is implemented in these commits:
b641e4b
99407c9
3494b16

BEWARE!

I just wrote the code, but I have not run it. That means that there could be some nasty bugs. Also in this version the data part of the cookie is limited to fixed 4000 chars in each chunk (we can add configuration later), to make room for name and flags.

I don't have time to test this thoroughly right now. But all the feedback is welcomed.

[bungle]

I made some obvious fixes after the comment above.

[bungle]

@zandbelt,

Okay, it got some nasty bugs, but those are resolved now.

Can you please try it out and report back to me if it works as expected.

Note: please also adjust your Nginx config as needed, e.g. to accept larger cookies, you may need to add something like this in nginx.conf:

large_client_header_buffers 4 16k;

[bungle]

This is now released as a part of 2.15 release.