I have an AspNet application which I'm authenticating using a separate AspNet Core application. It returns a JWT token which is then carried in a Http Cookie. The AspNet application validates each request has a valid JWT Token.

The immediate issue I face is the 4kb limit of HTTP Cookies. I need to carry permission information in the Token Claims which might exceed this limit.

I've thought about a couple of paths to solve this and would like advice:

  1. Compressing the token - however I noticed the compression rates aren't consistent for all tokens.

  2. Switching to a Http Header with a 16kb limit in IIS - I'm not sure yet how to set it from the AspnetCore side and I guess I'll need to set them on each request from the Client as they aren't persisted like Cookies.

  3. Store it in the Http Body and set it on each request from the Client.

Are there any other considerations which would be helpful to take into account here?

  • 1
    What is causing the permission information to be so large? Is it the sheer number of permissions or are you using rather long strings to identify each permission? – Bart van Ingen Schenau Oct 27 at 6:59
  • It's the volume of claims; a combination of volume and string length. As an estimate if we have 100 claims at 30 chars each the resultant token is already over 5kb. I hope we won't have more than that, but I'm looking to be on the safe side. – user3167162 Oct 27 at 9:44
  • Could you use an enumeration for the claims? Then you can probably encode each claim in as little as 2 bytes in the token (by using the numeric value), while still keeping human-readable names in the source code.. – Bart van Ingen Schenau Oct 27 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.