Clean up erroneous cookies when chunk size decreases

src/auth0-session/session/stateless-session.ts

@@ -122,24 +122,27 @@ export class StatelessSession<
     const value = await this.encrypt(session, { iat, uat, exp });
 
     const chunkCount = Math.ceil(value.length / this.chunkSize);
+
+    const existingCookies = new Set(
+      Object.keys(cookies).filter((cookie) => cookie.match(`^${sessionName}(?:\\.\\d)?$`))
+    );
+
     if (chunkCount > 1) {
       debug('cookie size greater than %d, chunking', this.chunkSize);
       for (let i = 0; i < chunkCount; i++) {
         const chunkValue = value.slice(i * this.chunkSize, (i + 1) * this.chunkSize);
         const chunkCookieName = `${sessionName}.${i}`;
         cookieSetter.set(chunkCookieName, chunkValue, cookieOptions);
-      }
-      if (sessionName in cookies) {
-        cookieSetter.clear(sessionName, cookieOptions);
+        existingCookies.delete(chunkCookieName);
       }
     } else {
       cookieSetter.set(sessionName, value, cookieOptions);
-      for (const cookieName of Object.keys(cookies)) {
-        if (cookieName.match(`^${sessionName}\\.\\d$`)) {
-          cookieSetter.clear(cookieName, cookieOptions);
-        }
-      }
+      existingCookies.delete(sessionName);
     }
+
+    // When the number of chunks changes due to the cookie size changing,
+    // you need to delete any obsolete cookies.
+    existingCookies.forEach((cookie) => cookieSetter.clear(cookie, cookieOptions));
     cookieSetter.commit(res, this.config.session.name);
   }
 

tests/auth0-session/session/stateless-session.test.ts

@@ -182,6 +182,29 @@ describe('StatelessSession', () => {
     expect(cookies).not.toHaveProperty(['appSession.0']);
   });
 
+  it('should clean up chunked cookies when chunk size reduces', async () => {
+    const baseURL = await setup(defaultConfig);
+    const appSession = await encrypted({
+      big_claim: randomBytes(2000).toString('base64')
+    });
+    expect(appSession.length).toBeGreaterThan(4000);
+    const cookieJar = toCookieJar(
+      {
+        'appSession.0': appSession.slice(0, 100),
+        'appSession.1': appSession.slice(100, 200),
+        'appSession.2': appSession.slice(200)
+      },
+      baseURL
+    );
+    const { data: session, res } = await get(baseURL, '/session', { cookieJar, fullResponse: true });
+    expect(res.headers['set-cookie']).toHaveLength(3);
+    expect(session.claims).toHaveProperty('big_claim');
+    const cookies = fromCookieJar(cookieJar, baseURL);
+    expect(cookies).toHaveProperty(['appSession.0']);
+    expect(cookies).toHaveProperty(['appSession.1']);
+    expect(cookies).not.toHaveProperty(['appSession.2']);
+  });
+
   it('should set the default cookie options on http', async () => {
     const baseURL = await setup(defaultConfig);
     const appSession = await encrypted();