Activity tab cookie grows without bound, eventually 400s the whole site

[kathrynalpert]

Description

The Activities widget keeps its list of running and finished tasks in a browser cookie. That cookie never shrinks on its own: every upload, migration, or JupyterHub start/stop adds an entry, and nothing removes it until the user clicks the X by hand. Because it's a cookie, the browser sends the whole thing on every request. Once it's big enough, the request headers go past Tomcat's 8 KB limit and Tomcat starts rejecting everything with a 400. At that point, the user has to clear cookies / close the tab to make any requests.

The fix is to stop using a cookie for this at all. It's pure client-side UI state that the server never reads, so moving it to localStorage takes it off the wire completely.

Steps to reproduce

1. Run XNAT behind something that adds large cookies, e.g. an ALB with OIDC auth
2. Kick off a bunch of activities: image uploads, processing dashboard jobs, JupyterHub dashboard start/stops.
3. Don't dismiss the finished ones.
4. Watch the cookie grow in DevTools (Application > Cookies). Once the full header set crosses 8 KB, every request starts coming back 400:

HTTP Status 400 – Bad Request
Message:   Request header is too large
Exception: java.lang.IllegalArgumentException: Request header is too large
    at org.apache.coyote.http11.Http11InputBuffer.fill(Http11InputBuffer.java:765)
    at org.apache.coyote.http11.Http11InputBuffer.parseHeader(Http11InputBuffer.java:959)
    at org.apache.coyote.http11.Http11InputBuffer.parseHeaders(Http11InputBuffer.java:588)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:294)
...
Apache Tomcat/9.0.118

Claude note: "This tells us the request made it all the way to Tomcat (vs reverse proxy), which died inside Http11InputBuffer while parsing the request headers. That's the maxHttpHeaderSize check, which defaults to 8192 bytes."

Workarounds

• Users can close the Activities panel ("Background processes")
• Admins can increase Tomcat's maxHttpHeaderSize