fix: admit longer session cookies by using a larger store

[kedorlaomer]

Description

Add an explicit cookie store with a bigger limit so that we can accept larger session cookies. Some OIDC providers require that.

Changelog

• server/src/api/login.go: in beginAuthProviderVerification, set a cookie store

Checklist

• [ x] I have performed a self-review of my own code
• [ x] I have commented my code, particularly in hard-to-understand areas
• [ x] The light- and dark-theme are both supported and tested
• [ x] The design was implemented and is responsive for all devices and screen sizes
• [ x] The application was tested in the most commonly used browsers (e.g. Chrome, Firefox, Safari)

(Optional) Visual Changes

none

[brandstetterm]

Hey @kedorlaomer
Thank you for your contribution! Could please explain what are the advantages of your changes?

[kedorlaomer]

We were using Microsoft's OIDC provider. It was sending session cookies which were larger than the default size of 4k. The backend wouldn't accept the login. Therefore, we had to increase the limit in our own fork.

Note that this does not mean that 1e9 bytes of memory and/or storage are used. It is just a limit. The original example (which I'd need to dig out) used the largest positive integer 😸.

EDIT: Didn't see that my PR description got truncated 😭

[Schwehn42]

@kedorlaomer we can definitely increase the limit, I would prefer some logical value over an arbitrary one though. Something like 16k or 32k should be more than enough, shouldn't it?

[kedorlaomer]

changed to 32k

[Schwehn42]

LGTM. Here's the PR you were referring to btw: markbates/goth#141

Note that before releasing, we will wrap this around a feature flag which is deactivated by default, as NewFilesystemStore is still an experimental feature. I'll tag you in the related PR. Thanks for your contribution!