django-agent-trust sets an unbounded number of cookies

[zerolab]

We have a project where there are a multitude of support accounts that a handful of people use. Every week or so, they get a "400 Bad Request - Request Header or Cookie Too Large" error and have to clear out all cookies.

[psagers]

In general terms, if a large number of Django users on a site trust a single user agent, that user agent acquires a similarly large number of django-agent-trust cookies.

I believe django-agent-trust currently sets a cookie for both trusted and untrusted agents; one improvement that might make sense is to only set cookies for trusted agents (and delete obsolete ones). This assumes that you're not actually trusting the agent for all of these different accounts.

A second mitigation might be to limit the number of cookies we set. There could be an AGENT_MAX_USERS setting or something and if we see too many cookies, we'll delete the oldest ones. That might be a slightly expensive operation, but only for those who run into it.

[zerolab]

Thank you for taking the time to consider this and respond

if a large number of Django users on a site trust a single user agent, that user agent acquires a similarly large number of django-agent-trust cookies.
in our case it is the same person with lots of support accounts. We use django-agent-trust in combination with https://github.com/django-otp/django-otp-agents, so the trust bit should only take effect for users that have an active OTP device.

AGENT_MAX_USERS may be one way of doing it. Or, extract https://github.com/django-otp/django-agent-trust/blob/master/src/django_agent_trust/middleware.py#L40 to its own method that one can override in a custom middleware and use that.

At the moment we override the entire AgentMiddleware.__call__ method which works, but feels iffy. Before v 1.x, that was process_response

[psagers]

I just pushed a proposed fix to the cookie-actions branch. This should clear out cookies for untrusted agents as well as adding a subclass hook for more complex cookie policies. Have a look and/or give it a whirl and let me know if this seems like it will do what you need.

[zerolab]

Hey @psagers,

AgentMiddleware.cookie_action() is exactly what we need. Nice touch on making _cookie_name a class method as it will simplify the tests too 👍🏼