diff --git a/laravel/session/drivers/cookie.php b/laravel/session/drivers/cookie.php index 321c4211..10f2cf8a 100644 --- a/laravel/session/drivers/cookie.php +++ b/laravel/session/drivers/cookie.php @@ -23,9 +23,7 @@ public function load($id) { if (\Laravel\Cookie::has(Cookie::payload)) { - $cookie = Crypter::decrypt(\Laravel\Cookie::get(Cookie::payload)); - - return unserialize($cookie); + return unserialize(Crypter::decrypt(\Laravel\Cookie::get(Cookie::payload))); } } @@ -43,6 +41,14 @@ public function save($session, $config, $exists) $payload = Crypter::encrypt(serialize($session)); + // A cookie payload can't exceed 4096 bytes, so if the encrypted payload + // is greater than that, we'll throw an exception so the developer can + // switch to another session driver for the application. + if (strlen($payload) > 4000) + { + throw new \Exception("Session payload too large for cookie."); + } + \Laravel\Cookie::put(Cookie::payload, $payload, $lifetime, $path, $domain); }