dsh-cookie-cleaner: Cleaning up accumulated dsh-auth-* cookies in the desktop client's cookie store
Every time the DSH desktop client starts with a random port, it leaves a `dsh-auth-*` local login cookie in the Electron cookie database. A new cookie is added each time the port changes. Each cookie is approximately 229 bytes. Accumulating to about 70 cookies exceeds the 16 KB request header limit, causing the server to return a 431 error and the client to report "desktop welcome Web authentication failed". `drscrewdriver`'s `dsh-cookie-cleaner` (v0.2.1, MIT, category: admin-security) addresses this issue using a dual approach of a plugin and a standalone command. The plugin performs read-only reporting of the number of accumulated cookies, request header usage, and the remaining margin before hitting the 431 limit. On Windows, it can also utilize handles already opened by the host for snapshot reading. The cleanup is performed by a CLI distributed with the package; it must be executed only after the client has fully exited and supports full deletion, deletion of expired cookies only, and dry-run modes. Before writing to disk, it creates a backup. Deletion operations are restricted to a host_key whitelist combined with name prefixes and refuse to write tables in unknown libraries. The plugin also provides profile patch health checks and one-click repair, capable of automatically determining if `connection.cookieMaxAgeDays` in `cordis.patch.yml` is configured correctly. This is applicable to desktop users encountering 431 startup failures and profile maintainers.
Read More