Chunked cookies should not exceed browser max

[adamjmcgrath]

Description

We currently allow 96 characters leeway for cookie attribute size (browser cookie max size (4096 Bytes) minus CHUNK_BYTE_SIZE)

This is not enough for scenarios where the user provides many cookie options or longer cookie domain or path options.

Since the cookie attributes are dynamic and can be quite long, we can calculate the cookie attributes length from serializing an empty cookie with the same options and measuring it.

References

fixes: #296

Testing

• Set a bunch of really long claims in your session (> 2000 chars) using the afterCallback hook

• Specify a bunch of cookie options that will exceed 96 chars (eg a long cookie domain/path)

• Login (you'll need to login on the same domain/path) and check the Size of your chunked appSession.{n} cookies in Chrome Devtools > Application > Cookie

• They should not exceed 4095 (Chrome Devtools doesn't inlclude the =)

• This change adds test coverage for new/changed/fixed functionality

Checklist

• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not main

[vercel]

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: https://vercel.com/auth0/nextjs-auth0/kj9jqhicz
✅ Preview: Canceled

[panva]

LGTM, the same should be applied to express-openid-connect as well i assume.