azuread securecookie: the value is too long about goth HOT 3 OPEN

Wild guess: try setting the store's MaxLength property to something large. It defaults to 4096 bytes (which may not be enough).

store.MaxLength = 10 * 1024

Edit: I think pgstore has it as a method:

store.MaxLength(10 * 1024)

YMMV

from goth.

I think I found the source of this issue while looking for a solution to my own problem.

This line is called every time you call CompleteUserAuth. It tries to place the AccessToken, RefreshToken, and ExpiresAt into the session weather you want it there or not. I commented this line out in the code and I was instantly able to get it working.

Like you I am not using the AccessToken. I am storing what I need in a JWT so storing it in the session is not needed. One fix might be to check the default store and if it doesn't match the used store don't execute this line.

if defaultStore == Store {
	err = StoreInSession(providerName, sess.Marshal(), req, res)
	if err != nil {
		return goth.User{}, err
	}
}

from goth.

This issue shows up when attempting to implement PKCE (punmechanic@4944a61, see #516) for openidconnect. Even a trivial attempt at implementing PKCE (whose recommended challenge size is 32b when generated using oauth2.GenerateVerifier) may result in the session overflowing its bounds when refresh tokens are enabled with a stock Keycloak server.

It may be that my naive attempt at storing the verifier within the session is unwise and it may be better to serialize the verifier in a different session.

from goth.