I have an AspNet application which I'm authenticating using a separate AspNet Core application. It returns a JWT token which is then carried in a Http Cookie. The AspNet application validates each request has a valid JWT Token.
The immediate issue I face is the 4kb limit of HTTP Cookies. I need to carry permission information in the Token Claims which might exceed this limit.
I've thought about a couple of paths to solve this and would like advice:
Compressing the token - however I noticed the compression rates aren't consistent for all tokens.
Switching to a Http Header with a 16kb limit in IIS - I'm not sure yet how to set it from the AspnetCore side and I guess I'll need to set them on each request from the Client as they aren't persisted like Cookies.
Store it in the Http Body and set it on each request from the Client.
Are there any other considerations which would be helpful to take into account here?