# Proxy auth backend does not support cookie splitting

**URL:** https://forum.opensearch.org/t/proxy-auth-backend-does-not-support-cookie-splitting/25407
**Category:** Security
**Created:** [June 30, 2025, 3:20pm UTC](https://forum.opensearch.org/t/proxy-auth-backend-does-not-support-cookie-splitting/25407 "2025-06-30T15:20:20Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![sdbruder](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@sdbruder](https://forum.opensearch.org/u/sdbruder)
#### Post date: [June 30, 2025, 3:20pm UTC](https://forum.opensearch.org/t/proxy-auth-backend-does-not-support-cookie-splitting/25407/1 "2025-06-30T15:20:20Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

opensearch 2.19.1 & equivalent dashboard.

**Describe the issue** :

After implementing dashboard auth with OpenID we ended up going to oauth2-proxy with the proxy authentication backend because of the lack of group overage when using an entra ID app, which solved our too-many-groups users, but now the cookie setup by dashboards is too big (16KB and something).

We’ve discovered that other backends have cookie splitting, but not proxy backend.

Any know way to solve this?

**Configuration** :

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

### Author: ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/9946_2.png) [@pablo](https://forum.opensearch.org/u/pablo)
#### Post date: [July 2, 2025, 10:17am UTC](https://forum.opensearch.org/t/proxy-auth-backend-does-not-support-cookie-splitting/25407/2 "2025-07-02T10:17:23Z")

</div>

@sdbruder According to OpenSearch GitHub the cookie splitting was implemented for SAML and OpenID to handle too many roles issue.

> <https://github.com/opensearch-project/security-dashboards-plugin/issues/1567>
>
> Hey,
> Currently i am using OpenSearch 1.3.X version and in this version i am fac…ing Too large Cookie issue https://github.com/opensearch-project/security/issues/374 this issue is solved in 2.7 version but i need some workaround for 1.3.X version to solve this issue. When i am using user with around 10-12 roles it works but when i increate roles up to 15 then not able to login to OpenSearch-dashboard.
> and can anyone tell me about how this works like where JWT token is created either in OpenSearch or in OpenSearch-dashboard and from where cookies sets.

I couldn’t find anything related to proxy.

Would you mind creating a feature reqeust in the OpenSearch Github?

---

<div class="post-metadata">

### Author: ![sdbruder](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@sdbruder](https://forum.opensearch.org/u/sdbruder)
#### Post date: [July 2, 2025, 11:11am UTC](https://forum.opensearch.org/t/proxy-auth-backend-does-not-support-cookie-splitting/25407/3 "2025-07-02T11:11:09Z")

</div>

Doing it. here: [[FEATURE] Cookie splitting is also needed in the proxy auth backend · Issue #2276 · opensearch-project/security-dashboards-plugin · GitHub](https://github.com/opensearch-project/security-dashboards-plugin/issues/2276)