Chunk the Nuxt session cookie instead of trimming its payload

[janithjay]

Purpose

The Nuxt quickstart's redirect-flow sign-in silently fails: the OAuth exchange completes successfully end-to-end (confirmed via backend logs - authorize, credential submission, code exchange, and JWKS fetch all return 200/302 as expected), but the user is bounced back to a signed-out state instead of landing on the authenticated page.

Root cause: createSessionToken (packages/nuxt/src/runtime/server/utils/session.ts) embedded the full access token, ID token, and refresh token - all JWTs themselves - as fields inside the session cookie's own JWT payload. With ThunderID's token claim set, the resulting cookie value routinely exceeds the browser's hard ~4096-byte per-cookie limit. The browser silently drops any Set-Cookie over that limit (confirmed in Chrome DevTools under "Malformed Response Cookies"), so the session is never actually established despite the server doing everything correctly.

Approach

Rather than trimming the payload, this changes splits the session cookie across numbered name.0, name.1, ... chunk cookies once it would exceed the per-cookie limit, and reassembles them transparently on read. The approach suggested in review #69 (comment), modeled on next-auth's own session cookie chunking.

idToken is not removed - unlike the alternative fix in #69, this branch keeps the full session payload (accessToken + idToken + refreshToken) intact.

Chunking absorbs the size instead of reducing it, so useServerSession()'s session.idToken keeps working exactly as it did before the bug was ever introduced.

The chunk name/size math itself (split/join/filterChunkNames) is framework-agnostic, so it now lives in @thunderid/node as a new CookieChunking utility rather than inside the Nuxt package.

packages/nuxt/src/runtime/server/utils/chunkedCookie.ts is now a thin h3 adapter over it (getChunkedCookie / setChunkedCookie / deleteChunkedCookie), wired into all 5 session-cookie touchpoints.

• Issuance (session.ts)
• Token refresh (token-refresh.ts)
• Two session reads (serverSession.ts)
• Sign-out (signout.post.ts).

@thunderid/nextjs builds its session cookie the same way and hits the same 4KB ceiling. it can adopt CookieChunking the same way in a follow-up.

The temp session cookie is untouched, it's always small and never needs chunking.

After the fix how __thunderid__session cookie was accepted

Related Issues

• fixex Nuxt quickstart: sign-in doesn't complete - redirects back to sign-in page thunderid#4881

Related PRs

• Supersedes Drop ID token from Nuxt session cookie to fix oversized-cookie login failure #69

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

• New Features

  • Added support for storing and retrieving large session cookies by safely splitting them into multiple browser cookies.
  • Session issuance and token refresh now support oversized session data without changing the authentication flow.

• Bug Fixes

  • Improved session sign-out and cookie replacement cleanup, preventing stale session cookie fragments from remaining in the browser.

• Tests

  • Added coverage for large cookies, transitions between storage formats, cleanup, deletion, and token refresh behavior.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: eefc9ad0-5b74-4d72-9cff-0fb12c719a74

📝 Walkthrough

Walkthrough

Nuxt now stores oversized session tokens across numbered cookies. Session reads, refreshes, and sign-out operations use chunked-cookie utilities. Unit tests cover writing, reading, stale-cookie cleanup, deletion, and token refresh behavior.

Changes

Chunked session cookies

Layer / File(s)	Summary
Chunked-cookie utility implementation packages/nuxt/src/runtime/server/utils/chunkedCookie.ts	Added utilities to read, write, split, reassemble, clean up, and delete base or numbered cookies.
Session lifecycle integration packages/nuxt/src/runtime/server/utils/session.ts, packages/nuxt/src/runtime/server/utils/serverSession.ts, packages/nuxt/src/runtime/server/utils/token-refresh.ts, packages/nuxt/src/runtime/server/routes/auth/session/signout.post.ts	Session issuance, retrieval, token refresh, and sign-out now use chunked-cookie handling.
Chunked-cookie and refresh validation packages/nuxt/tests/unit/chunked-cookie.test.ts, packages/nuxt/tests/unit/token-refresh.test.ts	Added coverage for chunked-cookie round trips, stale-cookie cleanup, deletion, and token-refresh behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant issueSessionCookie
  participant setChunkedCookie
  participant BrowserCookies
  participant getChunkedCookie
  participant useServerSession
  issueSessionCookie->>setChunkedCookie: Write session token
  setChunkedCookie->>BrowserCookies: Set base or numbered cookies
  BrowserCookies->>getChunkedCookie: Provide request cookies
  getChunkedCookie->>useServerSession: Return session token

Loading

Possibly related PRs

• thunder-id/javascript-sdks#51: Both changes modify Nuxt session-cookie handling in session.ts.
• thunder-id/javascript-sdks#69: Both changes address oversized Nuxt session cookies.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes directly address issue #4881 by chunking, reading, refreshing, and deleting oversized session cookies while preserving the full session payload.
Out of Scope Changes check	✅ Passed	All production and test changes support the linked issue and the stated objective of reliable oversized session-cookie handling.
Title check	✅ Passed	The title clearly and concisely describes the main change: chunking oversized Nuxt session cookies instead of trimming their payload.
Description check	✅ Passed	The description explains the problem, root cause, implementation, affected flows, testing, related work, and security checks; optional documentation and integration tests remain unchecked.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/nuxt/src/runtime/server/utils/chunkedCookie.ts`:
- Around line 33-37: Update findExistingCookieNames to match the base cookie
name and only names with a decimal numeric suffix after `${name}.`; exclude
prefixed cookies such as `${name}.metadata` from the returned cleanup list.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1fdf493e-1ea9-4904-9393-3e6e5b282198

📥 Commits

Reviewing files that changed from the base of the PR and between 7e1d437 and 4dba7b8.

📒 Files selected for processing (7)

• packages/nuxt/src/runtime/server/routes/auth/session/signout.post.ts
• packages/nuxt/src/runtime/server/utils/chunkedCookie.ts
• packages/nuxt/src/runtime/server/utils/serverSession.ts
• packages/nuxt/src/runtime/server/utils/session.ts
• packages/nuxt/src/runtime/server/utils/token-refresh.ts
• packages/nuxt/tests/unit/chunked-cookie.test.ts
• packages/nuxt/tests/unit/token-refresh.test.ts