Sign-in no longer breaks on an oversized cookie header.
Fixed
- Sign-in failed with
400 LineTooLong("Got more than 24570 bytes when reading: ...") (#60, also seen in #52 and #59). The sign-in proxy mirrored every Microsoft cookie onto the Home Assistant origin, including the multi-kilobyte HttpOnly tokens and the Akamai bot-manager cookies, and Microsoft's page scripts add a few more. The browser then sent all of it back on each request, and Home Assistant's HTTP server rejected the request before the integration could see it. The proxy now mirrors only the small cookies the page scripts can actually read, and removes the rest from the browser on every response. Thanks to @mobilutz for the precise analysis.
Changed
- When a request to Microsoft fails during sign-in, the warning now names the method, host and path, so a DNS filter or a missing IPv6 route is easy to spot (suggested by @MrTomRocker).
Note on the daily re-authentication (#52, #59)
Not fixed in this release. Several accounts, including mine since early October, lose the Family Safety session exactly 24 hours after the interactive sign-in, whatever the sign-in method or security settings. That limit is enforced by Microsoft and nothing on the integration side can extend it; see #52 for the details and the discussion.