Fixed
- Keep at most 3 sign-ins in progress instead of 5, and make the PKCE verifier 32 random bytes in base64url, 43 characters, the shortest RFC 7636 allows, instead of 128 hex characters. With PKCE, about 4 abandoned sign-ins overflowed Rails' 4 KB cookie session, and the next sign-in failed with
ActionDispatch::Cookies::CookieOverflow. Three sign-ins with an origin now take about 2.8 KB of an encrypted Rails session cookie, where five took about 5 KB. (#195)
Full Changelog: v1.10.0...v1.10.1