400 Request Header Or Cookie Too Large error in OIDC with WASOidcNonce cookies

[barbj]

Describe the bug
When OIDC authentication requests on not completed, the WASOidcNonce cookies are not deleted. After a while, you will get a 400 Request Header Or Cookie Too Large error.

Steps to Reproduce

1. Protect an endpoint with OIDC
2. Open a tab and hit the endpoint, don't login
3. Open another tab and hit the endpoint, don't login

The URL cookies have an expiration on them, but the nonce cookies do not.

Expected behavior
The WASOidcNonce cookies have an expiration date and are deleted after a few minutes.

Diagnostic information:

• Affected feature(s) openidConnectClient-1.0