Discourse session cookies (400 Request Header Or Cookie Too Large)

sam · December 30, 2019, 2:52am

I support auditing our session cookies and maybe just moving to default use our redis backed session that auto expires which is better anyway. @david any thoughts here?

github.com/discourse/discourse

lib/secure_session.rb

42758379b

# frozen_string_literal: true

# session that is not stored in cookie, expires after 1.hour unconditionally
class SecureSession
  def initialize(prefix)
    @prefix = prefix
  end

  def self.expiry
    @expiry ||= 1.hour.to_i
  end

  def self.expiry=(val)
    @expiry = val
  end

  def set(key, val, expires: nil)
    expires ||= SecureSession.expiry
    Discourse.redis.setex(prefixed_key(key), expires.to_i, val.to_s)
    true

This file has been truncated. show original

Topic		Replies	Views
Add path to cookie Development	48	8385	September 5, 2025
Setting the session token '_t' on the entire domain, not just my subdomain Development	6	5622	May 1, 2016
Purpose of Cookie '_t' Product Support	1	948	November 19, 2020
Session Timeout Data & reporting	66	10720	January 4, 2025
Sessions are very short, even though default session length of 60 days is in place Product Support unsupported-install	2	182	July 14, 2025

Discourse session cookies (400 Request Header Or Cookie Too Large)

Related topics