Repeating message creates huge session object in the database

Patch.

Raising priority as this could lead to nasty denial of service attacks.

Looks good! Thanks

We also have a large site with malicious crawlers, but we took another path.
Use JavaScript to show the messages instead of the classic Drupal message that sets an anonymous session to show it.

https://www.drupal.org/project/r4032login/issues/3425396 ✨ Do not set anonymous session to avoid lost cacheability on redirection Needs review