I am developing a .NET 8 Web API app that uses the new “bearer token” authentication option to authenticate users via a token, like this:

services.AddAuthentication(BearerTokenDefaults.AuthenticationScheme)
    .AddBearerToken(options =>
    {
        options.BearerTokenExpiration = TimeSpan.FromHours(24);
    });

and then I log in users and generate the bearer token like this:

var userClaimsPrincipal = ... //generate claims principal
var token = Results.SignIn(userClaimsPrincipal);

This in itself works correctly, however I have an issue with my deployment environment that makes it problematic: the company proxy that is in use where I need to deploy this app blocks HTTP requests that have headers that are over a certain length. And in my case, some users have so many claims (due to extensive use of AD groups in this organization) that their token becomes too large and the request gets blocked.

Unfortunately, I do not have control over how the proxy is configured, so I need to find a solution to make the token smaller.

At the moment my idea for a workaround would be to limit the number of claims I include in the token, since I know my app is only interested in some of them, but I would be interested in knowing if there are more “proper” solutions.

For example, is it possible to store the claims server-side, and in the token only include an ID that is then used server-side to fetch the claims for that user? Or is there any other built-in mechanism that does something like this, before I waste time implementing a custom ClaimsProvider or something like that?