Store auth requests in session, not in cookies.

aiakos/openid_provider/views/auth_request.py

@@ -38,7 +38,7 @@ def _load_data(request):
 			return
 
 	try:
-		return id, json.loads(request.COOKIES['auth_request_' + id])
+		return id, json.loads(request.session['auth_requests'][id])
 	except Exception as e:
 		log.warning(e)
 

aiakos/openid_provider/views/authorization.py

@@ -48,7 +48,7 @@ class AuthorizationView(View):
 			id = uuid4().hex
 
 			res = redirect(reverse('openid_provider:select-account') + '?request=' + id)
-			res.set_cookie('auth_request_' + id, data)
+			request.session.setdefault('auth_requests', {})[id] = data
 			return res
 
 		except OAuthError as e: