Relaystate cookies request size limit exceeded

[Cantor, Scott]

On 10/6/20, 5:46 AM, "users on behalf of Philip Brusten" <users-bounces at shibboleth.net on behalf of philip.brusten at kuleuven.be> wrote:

>    When users make lots of sign-in requests, without actually logging in, 
>    they collect several relayState-cookies and eventually the request size 
>    limit exceeds.

That should never happen, the code cleans them at the same time it cleans up relay state cookies (and it does so even if the actual relay state mechanism is not set to cookie). How many cookies are there before the problem happens?

>    The relayState cookies are prefixed with "_opensaml_req_ss:db".

That's not the relay state, those are for request correlation.

>    The relayState "cookie" mechanism provides a clean-up suffix ":n". Is it 
>    possible to support this suffix when using the ODBC-storageservice for 
>    the relayState?

The setting applies to both types of cookies but when the relay state setting isn't set to cookie there's no place to set the limit value and it just uses 20 as a default. The request limit here has to be draconian for this to be a problem unless there's a real bug.

-- Scott