diff --git a/auth/callback.php b/auth/callback.php index 6ec2c31..70b54ae 100644 --- a/auth/callback.php +++ b/auth/callback.php @@ -105,8 +105,14 @@ setcookie('descope_user_email', '', auth_cookie_options(time() - 42000)); setcookie('descope_user_phone', '', auth_cookie_options(time() - 42000)); setcookie('descope_custom_attributes', '', auth_cookie_options(time() - 42000)); setcookie('descope_role_names', '', auth_cookie_options(time() - 42000)); -auth_set_descope_session_cookies($normalizedUser); -auth_set_baron_session_cookies($normalizedUser, $claims); +setcookie('baron_user', '', auth_cookie_options(time() - 42000)); +setcookie('baron_claims', '', auth_cookie_options(time() - 42000)); +setcookie('baron_provider', '', auth_cookie_options(time() - 42000)); + +// BARON users are kept in the server-side PHP session above. Do not mirror +// the normalized user and the complete OIDC claims into cookies: the claims +// may contain a large tenants/roles payload and make the next Cookie header +// exceed Apache's request-header limit for only some accounts. $clientSessionPayload = [ 'loginId' => (string) ($normalizedUser['loginIds'][0] ?? ''), @@ -121,7 +127,6 @@ $clientSessionPayload = [ 'userRole' => (string) (($normalizedUser['roleNames'][0] ?? '')), 'authProvider' => 'baron', 'sessionJwt' => $idToken !== '' ? $idToken : (string) ($tokenData['access_token'] ?? ''), - 'baronClaims' => json_encode($claims, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES), ]; $jsonPayload = json_encode($clientSessionPayload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES); @@ -154,6 +159,9 @@ echo <<