Chunk the Next.js session cookie to avoid the 4KB browser limit

[janithjay]

Purpose

@thunderid/nextjs builds its session cookie the same way the Nuxt SDK used to: SessionManager.createSessionToken embeds the full access token, ID token, and refresh token inside the session cookie's own JWT payload. That routinely exceeds the browser's hard ~4096-byte per-cookie limit, and browsers silently drop any Set-Cookie over that limit. So a user can complete the OAuth exchange successfully and still end up signed out. This is the same root cause fixed for Nuxt in PR #74, just not yet ported to nextjs.

Approach

Reuses the CookieChunking utility added to @thunderid/node in PR #74 (chunk name/size math only - no cookie I/O of its own). Adds a thin packages/nextjs/src/utils/chunkedCookie.ts adapter (getChunkedCookie / setChunkedCookie / deleteChunkedCookie) over it, then wires that into every place @thunderid/nextjs touches the session cookie,

• Read-only server actions: getAccessToken, getSessionPayload, getSessionId.
• Write/delete server actions: signInAction, handleOAuthCallbackAction, refreshToken, signOutAction, clearSession.
• sessionUtils.ts (shared helpers used by the middleware).
• thunderIDProxy.ts middleware - reads via NextRequest.cookies, writes via NextResponse.cookies, and rewrites the raw Cookie request header it forwards downstream so the same-request Server Component render sees the fresh, possibly-chunked session immediately.

The temp session cookie is untouched, it's always small and never needs chunking.

Related Issues

• N/A

Related PRs

• Depends on Chunk the Nuxt session cookie instead of trimming its payload #74 , not main until Chunk the Nuxt session cookie instead of trimming its payload #74 merges )

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 88b87ffe-eeb4-443d-afd7-45f57403114b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}