ActionDispatch::Cookies::CookieOverflow but the cookie is small

Question

I recently started receiving a ActionDispatch::Cookies::CookieOverflow from a simple form upload. Looking at the POST request, the Content-Length is 25000+, but the cookie is only 520 characters and contains only the session cookie. ActionDispatch::Cookies::MAX_COOKIE_SIZE is 4096.

This is the form in question. It's an ActiveAdmin sidebar.

<link rel="stylesheet" href="http://code.jquery.com/ui/1.12.1/themes/base/jquery-ui.css">
<%= form_tag "/import/from_csv", method: :post, multipart: true do %>
  Upload a CSV file.
  <%= label_tag(:file, 'CSV file:') %>
  <%= file_field_tag(:file) %>

  <%= label_tag(:reason, "Default Reason:") %>
  <%= select_tag(:reason,
        options_for_select(Rails.configuration.x.reasons, "unknown")
      )
  %>

  <%= label_tag(:source, "Default Source:") %>
  <%= text_field_tag(:source, 'csv') %>

  <%= submit_tag("Import",  id: "import") %>
<% end %>

We're using the default session store with the JSON cookies serializer. We're not doing anything special with cookies. I tried clearing the cookie, same problem.

What could be causing this?

• Rails 6.1.3.2
• ActiveAdmin 2.9.0
• Ruby 2.7.2
• Devise 4.7.3

Answer 1

Looking at the cookie value in a debugger, what's happening is each of 50 flashes is being put into the session cookie. This bloats out the session value to just under 4k. Encryption puts it over the line.

I'll switch to session cookies.