title: Laravel EncryptCookies::decrypt() throws exception randomly in Chrome
body: <p>It seems cookie decryption is randomly failing in Google Chrome.</p>
  
  <pre><code>protected function decrypt(Request $request)
  {
      foreach ($request-&gt;cookies as $key =&gt; $c) {
          if ($this-&gt;isDisabled($key)) {
              continue;
          }
  
          try {
              $request-&gt;cookies-&gt;set($key, $this-&gt;decryptCookie($c));
          } catch (DecryptException $e) {
              dd('exception: ', $e);  // added by me to see the failure
              $request-&gt;cookies-&gt;set($key, null);
          }
      }
  
      return $request;
  }
  </code></pre>
  
  <p>Here is the output when it fails:</p>
  
  <pre><code>"exception: "
  DecryptException {#318 ▼
    #message: "The payload is invalid."
    #code: 0
    #file: 
  "C:\...\vendor\laravel\framework\src\Illuminate\Encryption\Encrypter.php"
    #line: 191
  </code></pre>
  
  <p>There are a couple of posts about X-XSRF-TOKEN failing on decryption sometimes: </p>
  
  <p><a href="https://stackoverflow.com/questions/44652194/laravel-decryptexception-the-payload-is-invalid">Laravel DecryptException - The payload is invalid</a> <a href="https://www.reddit.com/r/laravel/comments/4xl01y/xxsrftoken_fails_frequently_on_decryption_and/" rel="nofollow noreferrer">https://www.reddit.com/r/laravel/comments/4xl01y/xxsrftoken_fails_frequently_on_decryption_and/</a></p>
  
  <p>Strangely, whenever I refresh the page, sometimes the DecryptException is thrown but most of the time the try statement succeeds. When I test in IE and Firefox, the try statement always succeeds.</p>
  
  <p>I deleted cookies etc. from Chrome but that didn't fix the issue.</p>
  
  <p>I appreciate any thoughts as I have spent many, many hours on this problem.</p>
  
  <hr>
  
  <p><strong>UPDATE 1</strong>: When I remove the 'remember_web_...' cookie, I no longer get an exception. Still, I have no idea why the remember cookie would cause a decryption exception sometimes in Chrome.</p>
  
  <hr>
  
  <p><strong>UPDATE 2</strong>: More puzzle pieces. When decrypt() throws the exception, the cookie it is decrypting is only a part of the request cookie which explains the exception. For example, the cookie in the request header of the client is</p>
  
  <pre><code>eyJpdiI6IjRaZ3dpVlNMRjB0TEJiNCtRVlUrN2c9PSIsInZhbHVlIjoicHJNYUdOMDc3azdJXC9
  sV0lYTThZTDB6aERXV1JwTFhTb2xVbEdEaXhVekJmTkFoVGVQalFEK2ZqamNPWUFHcVREZE9cL3
  pjQjRGdHBcL25scENJN0UxRGc9PSIsIm1hYyI6IjI5MzdhNzJiNmNhOTMyNmE2NjhmNzI4ZGRlM
  2ZlZWVjM2Q3NGFiYmEzMGZhZmIxZWZlYWNmYzNlZjAzOWU0OWIifQ%3D%3D
  </code></pre>
  
  <p>But the cookie being decrypted is missing the last 89 characters of the client request cookie:</p>
  
  <pre><code>eyJpdiI6IjRaZ3dpVlNMRjB0TEJiNCtRVlUrN2c9PSIsInZhbHVlIjoicHJNYUdOMDc3azdJXC9
  sV0lYTThZTDB6aERXV1JwTFhTb2xVbEdEaXhVekJmTkFoVGVQalFEK2ZqamNPWUFHcVREZE9cL3
  pjQjRGdHBcL25scENJN0UxRGc9PSIsIm1hYyI6IjI5Mzd
  </code></pre>
  
  <p>Here is a screenshot illustrating the issue:
  <a href="https://i.stack.imgur.com/kIJIk.png" rel="nofollow noreferrer">cookie mismatch</a></p>
  
  <p><strong>I think the question now is, why is the cookie in the server-side Request header missing part of the cookie from the client-side request header?</strong></p>
  
  <hr>
  
  <p><strong>UPDATE 3</strong>: The amount of missing characters in the cookie seems dependent on the cookie name length. When I use a really long cookie name, the amount of missing characters increases and vice versa. This also explains why removing the remember cookie or the XSRF cookie fixes the issue. Again, this only fails sometimes so I am not sure why it isn't constant.</p>