Reduce IdentityServer4 access_token length by removing claims in profile service - asp.net

Question

I am working on IdentityServer4 application. The generated Access_token length is becoming too lengthy due to the claim value added to the context.IssuedClaims. I tried to remove claim type called "entity" and it helps in reducing the access_token length. But its removing the claim from ClaimsPrincipal as well. Is there a way I can add this claim back to my ClaimsPrincipal so that I can access it from all my client applications? Currently I am invoking a separate API to get the claim back every time. Below is the code from my ProfileService where I am filtering the claim.
public async Task GetProfileDataAsync(IdentityServer4.Models.ProfileDataRequestContext context)
{
var user = await _userManager.GetUserAsync(context.Subject);
var principal = await _claimsFactory.CreateAsync(user);
//Retrieve all the claims associated with the user
var claims = from claimsdata in principal.Claims select new System.Security.Claims.Claim(claimsdata.Type, claimsdata.Value);
//Exclude claim type "entity" since its huge in numbers and causing access_token size to grow
var claimsWithoutEntity = claims.Where(x => x.Type != "entity");
context.IssuedClaims.AddRange(claimsWithoutEntity);
var roleClaims = _roleService.GetRoleClaims(user);
context.IssuedClaims.AddRange(roleClaims);
}

Answer 1

A different alternative to reduce the cookie size without modifying the access token is to create a SessionStore, and you can set it using the SessionStore parameter here:
}).AddCookie(options =>
{
...
options.SessionStore = new MySessionStore();
})
What does a SessionStore do?
See this picture, taken from one of my training classes:
Here's a sample in-memory store
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Serilog;
using System;
using System.Collections.Concurrent;
using System.Threading.Tasks;
namespace SessionStore
{
/// <summary>
/// MySessionStore
///
/// Custom session store, to hold the tokens in memory instead of storing them inside the Cookie.
///
/// This provides an abstract storage mechanic to preserve identity information on the server while
/// only sending a simple identifier key to the client. This is most commonly used to mitigate issues
/// with serializing large identities into cookies.
///
/// TODO:
/// - Needs logic to remove older items, otherwise we might run out of memory here.
/// - Use the MemoryCache instead of a dictionary?
///
/// Written by Tore Nestenius to be used in the IdentityServer in production training class.
/// https://www.tn-data.se
///
/// </summary>
internal class MySessionStore : ITicketStore
{
private readonly Serilog.ILogger _logger;
private readonly ConcurrentDictionary<string, AuthenticationTicket> mytickets = new();
public MySessionStore()
{
_logger = Log.Logger;
}
/// <summary>
/// Remove the identity associated with the given key.
/// </summary>
/// <param name="key"></param>
/// <returns></returns>
public Task RemoveAsync(string key)
{
_logger.Debug("MySessionStore.RemoveAsync Key=" + key);
if (mytickets.ContainsKey(key))
{
mytickets.TryRemove(key, out _);
}
return Task.FromResult(0);
}
/// <summary>
/// Tells the store that the given identity should be updated.
/// </summary>
/// <param name="key"></param>
/// <param name="ticket"></param>
/// <returns></returns>
public Task RenewAsync(string key, AuthenticationTicket ticket)
{
_logger.Debug("MySessionStore.RenewAsync Key=" + key + ", ticket = " + ticket.AuthenticationScheme);
mytickets[key] = ticket;
return Task.FromResult(false);
}
/// <summary>
/// Retrieves an identity from the store for the given key.
/// </summary>
/// <param name="key"></param>
/// <returns></returns>
public Task<AuthenticationTicket> RetrieveAsync(string key)
{
_logger.Error("MySessionStore.RetrieveAsync Key=" + key);
if (mytickets.ContainsKey(key))
{
var ticket = mytickets[key];
return Task.FromResult(ticket);
}
else
{
return Task.FromResult((AuthenticationTicket)null!);
}
}
/// <summary>
/// Store the identity ticket and return the associated key.
/// </summary>
/// <param name="ticket"></param>
/// <returns></returns>
public Task<string> StoreAsync(AuthenticationTicket ticket)
{
//Only add one at the time to avoid race conditions
lock(this)
{
//Make sure the key is does not already exist in the dictionary
bool result = false;
string key;
do
{
key = Guid.NewGuid().ToString();
result = mytickets.TryAdd(key, ticket);
} while (result == false);
string username = ticket?.Principal?.Identity?.Name ?? "Unknown";
_logger.Debug("MySessionStore.StoreAsync ticket=" + username + ", key=" + key);
return Task.FromResult(key);
}
}
}
}