bug: Request Header Fields Too Large

[tampler]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

Chromimum browser for Ubuntu 24 returns an error: Request Header Fields Too Large for the consent flow POST request ⛔

Presumably, the reason is the cookie size is TOO large 🙄

Attached cookies

• Login session cookie - mp_sess in my request
• Consent flow cookie. This is autogenerated and in my case the name is mp_consent_csrf_dev

Screenshots

Reproducing the bug

1. Setup kratos and hydra
2. Implement login, register and consent flows
3. Add cookie like this. Golang

// get consent cookie from headers
var cookie string

c.Request().Header.VisitAllCookie(func(_key, value []byte) {

key := string(_key)

if strings.Contains(string(key), "consent") || key == browserSession {
  cookie += fmt.Sprintf("%s=%s;", key, string(value))
}
})

Relevant log output

2025-01-16T15:35:46.256+0300    DEBUG   idp     consent cookie  {"cookie": "mp_sess=MTczNzAzMDk0NXxRNFZGb1ppVkpfWkllV0N2VV9rcENyMkRQU1c0bFhnUlNsZjdWdU1pWFVjaVVLSVZZLXJRdEU4MXNqMTZUZmp4akZQejY5d2gtdFNZZk10SFVyMURkcG9LYUYwbTIzWlFNZFhsc05hUGtrT1JvcGxic2UzMDNPaTNuOWpnRkZtZFplWVExem1iNnc0Y2wzZG1NY0lESXFsRUtIcXp6ZC1OZnUyWUM4VmFBbTdYdVk5b3NZSmdRTThOcno0X095MXJtLWVPQzhNRDlsdE5PZklERGRDMXdqeVZkZmdrM0FSTXB1SVE0Zko0Sjk4cHRCbEg3N1V3aGxEdjlwTDZZVzBwXzhFOXA1V08yVndaVUEtU3dvRXF8XwSlDArXO23vikHahSg6_SjDMRn7Lq2g2Thrs-Nlrjk=;mp_consent_csrf_dev_4001632846=MTczNzAzMDk0NXxLUFI4RXo0X2Nrb3NJWE95TGNYOWlybmZsVkJ2bWpETjZqYi1KcUU1dEt3SU9GV2lJekZLUW1MUVBNbk1Qc2VUNGdFdGlaRzhwYmIzRkhKV09KcWxQUnRIWWJ4MVdQMHFJa1FSYWthNENpbndXVHNxZVgyVEg3YXRsSTFtfF15oJHnE2j08LmTrrRIT-2RP39QUXuLJm8fiTEyJjg3;"}
2025-01-16T15:35:46.433+0300    DEBUG   idp     requested scope {"scope": "openid"}
2025-01-16T15:35:46.433+0300    DEBUG   idp     requested scope {"scope": "offline"}

Relevant configuration

serve:
  cookies:
    names:
      session: mp_sess
      login_csrf: mp_login_csrf
      consent_csrf: mp_consent_csrf

Version

v2.3.0-pre.1

On which operating system are you observing this issue?

None

In which environment are you deploying?

None

Additional Context

OS: Ubuntu 24.04

Browser : 131.0.6778.264
Kratos: v1.3.1
Hydra: v2.2.3-pre.1