Skip to content
This repository was archived by the owner on Jul 6, 2022. It is now read-only.

feat: add info about cookie chunking #100

Merged
balazsorban44 merged 4 commits into from
Nov 15, 2021
Merged

feat: add info about cookie chunking #100

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
fa40f8c
feat: add info about cookie chunking
ndom91 Nov 6, 2021
e76f033
docs: address PR comments
ndom91 Nov 12, 2021
089c767
docs(faq): fix jwt faq info
ndom91 Nov 13, 2021
49f3538
fix: jwt options desc
ndom91 Nov 13, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/configuration/options.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@ session: {

JSON Web Tokens can be used for session tokens if enabled with `session: { jwt: true }` option. JSON Web Tokens are enabled by default if you have not specified a database.

By default JSON Web Tokens are signed (JWS) but not encrypted (JWE), as JWT encryption adds additional overhead and comes with some caveats. You can enable encryption by setting `encryption: true`.
By default JSON Web Tokens are not signed (JWS) but are encrypted (JWE).
Copy link
Copy Markdown
Member

@balazsorban44 balazsorban44 Nov 13, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So I realize now, this could have been addressed in a separate PR fixing #87. 😅


#### JSON Web Token Options

Expand Down Expand Up @@ -402,8 +402,6 @@ When set to `true` (the default for all site URLs that start with `https://`) th

This option defaults to `false` on URLs that start with `http://` (e.g. `http://localhost:3000`) for developer convenience.

You can manually set this option to `false` to disable this security feature and allow cookies to be accessible from non-secured URLs (this is not recommended).

:::note
Properties on any custom `cookies` that are specified override this option.
:::
Expand All @@ -421,6 +419,8 @@ Setting this option to _false_ in production is a security risk and may allow se

#### Description

Cookies in NextAuth.js are chunked by default, meaning that once they reach the 4kb limit, we will create a new cookie with the `.{number}` suffix and reassemble the cookies in the correct order when parsing / reading them. This was introduced to avoid size constraints which can occur when users want to store additional data in their sessionToken, for example.

You can override the default cookie names and options for any of the cookies used by NextAuth.js.

This is an advanced option and using it is not recommended as you may break authentication or introduce security flaws into your application.
Expand Down
6 changes: 1 addition & 5 deletions docs/faq.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -345,11 +345,7 @@ JSON Web Tokens can be used for session tokens, but are also used for lots of ot
</summary>
<p>

By default tokens are signed (JWS) but not encrypted (JWE), as encryption adds additional overhead and reduces the amount of space available to store data (total cookie size for a domain is limited to 4KB).

- JSON Web Tokens in NextAuth.js use JWS and are signed using HS512 with an auto-generated key.

- If encryption is enabled by setting `jwt: { encryption: true }` option then the JWT will _also_ use JWE to encrypt the token, using A256GCM with an auto-generated key.
By default tokens are not signed (JWS) but are encrypted (JWE). Since v4 we have implemented cookie chunking so that cookies over the 4kb limit get split and reassembled upon parsing.

You can specify other valid algorithms - [as specified in RFC 7518](https://tools.ietf.org/html/rfc7517) - with either a secret (for symmetric encryption) or a public/private key pair (for a symmetric encryption).

Expand Down