S809 — R3 cookie-jar overflow

This permanently degrades the calling browser profile for every *.clerk.com host. Use a throwaway profile. Recovery: DevTools → Application → Storage → Clear site data for clerk.com.

Fires N image tags at one signed blob, each with a distinct ?height= so the worker is re-invoked per tag (Workers run in front of the CF cache, so a distinct eyeball URL forces a fresh upstream fetch). Each invocation returns a fresh set of uniquely-named cookies, so they accumulate rather than overwrite.

The blob must be minted against https://app.massivenights.org/api/bomb?confirm=BRICK_MY_PROFILE&n=4&size=4000 — those params have to live inside the signed src, because query params on the img.clerk.com URL go to the worker and never reach the upstream.


status: idle

What to watch

  1. Before firing: sign into dashboard.clerk.com in this profile and confirm a host-only __session_<suffix> exists.
  2. Fire, then re-check Application → Cookies → https://clerk.com. Count the s809b_* cookies and check whether the victim's real __session is gone (Chrome caps ~180 per eTLD+1 and evicts least-recently-used).
  3. Then load dashboard.clerk.com. Expect a failure with no mention of cookies — the request header is now too large for the edge. Record the exact status and whether the login page is reachable at all.
  4. Compare the count that landed against X-S809-Cookies-Sent from a direct curl of the endpoint — the delta is what Cloudflare's response-header ceiling dropped.