JWT Bearer token content length limited by some public firewall

We have an issue with JWT token sizes.

We currently have an Angular front-end and an authentication service via IdentityServer4. As soon as authentication is performed, the next call is to retrieve the user's claims via the userprofile endpoint. In this call, we return various information in the user claims in the HTTP request header (in the Bearer token) to the Angular front end.

On some firewalls, with the IPS (Intrusion Prevention System, ex: Stormshield, Palo alto, Azure) option active and the HTTP protocol, requests are filtered and the token is truncated with the error message that it is too long. In reality, the bearer token content under the IPS protocol cannot exceed 1000 bytes.

> To summarize:
> Front Angular -> Sends a connection request to IdentityServer4
> IdentityServer4 -> Responds OK
> Front Angular -> Request infousers route from IdentityServer4
> IdentityServer4 -> Sends claims through bearer token from IProfileService.GetProfileDataAsync()
> Firewall -> Intercepts and opens packets, detects that token is too large, truncates and re-encodes it
> Front Angular -> ERRCONRESET error because the JWT token is inconsistent in the HTTP header.

Has anyone encountered a similar problem?

Do you have a solution or an idea for reducing the size of the JWT token?

Is the implementation and use of the bearer and claims correct?

Here are a few configurations:

config.cs of IdentityServer:

new Client
{
	ClientId = "myClient",
	ClientName = "myClientName",
	AccessTokenType = AccessTokenType.Jwt,
	AllowedGrantTypes = GrantTypes.Implicit,
	AllowAccessTokensViaBrowser = true,
	AlwaysSendClientClaims = true,
	AlwaysIncludeUserClaimsInIdToken = true,
	RequireConsent = false,
	RedirectUris = { urlClient },
	PostLogoutRedirectUris = { urlClient },
	AllowedCorsOrigins = { urlClient },
	AccessTokenLifetime = 86400,
	IdentityTokenLifetime = 86400,
	AllowedScopes =
	{
		IdentityServerConstants.StandardScopes.OpenId,
		IdentityServerConstants.StandardScopes.Profile,
		IdentityServerConstants.StandardScopes.Email,
		SomeConstant,
		SomeConstant,
		SomeConstant,
	}
}

ConfigureServices() of IdentityServer:

services.ConfigureNonBreakingSameSiteCookies();
services.AddRazorPages().AddMvcOptions(options => options.EnableEndpointRouting = false).SetCompatibilityVersion(CompatibilityVersion.Latest);
services.AddSingleton(new ConfigurationIdentityServer("myUrl", _Configuration.GetSection("applicationServer").Get<ConfigurationApplicationServer>()));
services.AddSingleton<IResourceOwnerPasswordValidator, ResourceOwnerPasswordValidator>();

var builder = services.AddIdentityServer()
	.AddInMemoryIdentityResources(Config.GetIdentityResources())
	.AddInMemoryApiScopes(Config.GetApiScopes())
	.AddRedirectUriValidator<MyUriValidator>();
builder.Services.AddSingleton<IUserRepository, UserRepository>();
builder.AddProfileService<CustomProfileService>();
builder.AddClientStore<CustomClientStore>();

services.AddScoped<IWireService, WireService>();
services.AddCors(setup => setup.AddDefaultPolicy(b => b.AllowAnyOrigin().AllowAnyHeader().AllowAnyMethod()));

builder.AddCustomTokenRequestValidator<CustomTokenRequestValidator>();
builder.AddDeveloperSigningCredential();

And Configure():

if (env.IsDevelopment())
	app.UseDeveloperExceptionPage();

app.UseStaticFiles();
app.UseCookiePolicy();
app.UseRouting();
app.UseCors();
app.UseIdentityServer();
app.UseMvcWithDefaultRoute();
app.UseAuthentication();

An example of a JWT token:

{
  "alg": "RS256",
  "kid": "F5B66993EBF31790213A4D52AD81F98E",
  "typ": "at+jwt"
}
{
  "nbf": 1687784431,
  "exp": 1687870831,
  "iss": "myAuthUrl",
  "client_id": "myClient",
  "sub": "1",
  "auth_time": 1687784425,
  "idp": "local",
  "profile": "Admin Admin",
  "key0": "Admin",
  "key1": "1",
  "key2": "1",
  "key3": "True",
  "nb": "0",
  "jti": "3B8CDF16E4AC8490B5F9C2E0C5D7A6CD",
  "sid": "920D817F645FF497490E6AC9D25D1C67",
  "iat": 1687784431,
  "scope": [
    "openid",
    "profile",
    "email",
    "SomeConstant",
    "SomeConstant",
    "SomeConstant"
  ],
  "amr": [
    "pwd"
  ]
}

Thanks in advance for your ideas

1000 bytes is a very strict limitation. Your (very short) sample token has ~600 chars, then add base64 overhead ~25% and you have ~800 chars in token.

There are several options:

• use short claim names and short claim values, e.g. use value 1 instead of "True", use C# enums instead of fixed strings, use single char claim names. String constants very quickly increase size of the token;
• do not put non-critical claims into token and get other information from DB. You can create an additional endpoint that returns extended user information when needed;
• Instead of multiple claims, you can try to encode everything into single "uber-claim" in protobuf format (or any other binary format) and optionally compress it using one of the compression algorithms (if it makes sense, keep in mind base64 overhead).

There is a concept of reference tokens in IdentityServer that allows you to get really short access tokens.

Read more about it here https://docs.duendesoftware.com/identityserver/v6/tokens/reference/