Validation: westside-admin#24 — cookie size fix
Ticket
forgejo_admin/westside-admin#24 (PR #25, merged). P1 BUG: session cookie value (4719 B with id_token) exceeded browser per-cookie limit, causing infinite redirect loop. Fix: drop id_token from session payload.Environment
- URL:
https://westside-admin.tail5b443a.ts.net - Cluster image SHA at validation:
63e708dc(post-#25 plus #27 azp fix) - Test user:
draneylucas@gmail.com
Checks
| # | Criterion | How to Verify | Result | Evidence |
|---|---|---|---|---|
| 1 | session cookie value < 4096 bytes | curl auth flow → capture Set-Cookie len | PASS | Live measurement: <strong>3151 bytes</strong> (was 4719 B pre-fix). 945-byte headroom. |
| 2 | browser keeps the cookie through the redirect chain | Playwright headless Chromium SSO round-trip | PASS | Browser landed at /, page rendered <code><h1>westside-admin</h1></code>. No redirect loop. |
| 3 | logout still works without id_token_hint | POST /auth/logout, observe redirect to Keycloak SLO | PASS | Per <code>validation-16-2026-05-03</code> check #4 — Keycloak <code>/logout</code> redirect still fires; <code>id_token_hint</code> param omitted (acceptable per OIDC spec) |
| 4 | no regression on /auth/callback failure paths | Static QA review of PR #25 | PASS | State validation, code exchange, error mapping unchanged |
Verdict
PASS — bug no longer reproduces. SSO round-trip terminates cleanly.
Discovered Issues
Bug #26 (JWT aud=account vs expected westside-admin) was unmasked by this fix — the cookie-size loop hid it. Bug #26 was filed, fixed in PR #27, and validated in
validation-26-2026-05-03 (or via the integrated validation in validation-15).