When a user is a member of many groups in Entra, they end up with HTTP 431

[hajekj]

Reopening #435 and #425

Why would you store group memberships in the cookies? If it is because it returns with the token, you can just configure the app registration to omit them - https://learn.microsoft.com/en-us/entra/identity-platform/optional-claims?tabs=appui#configuring-groups-optional-claims

I tried looking through the docs and didn't find any reference to usage of groups anyways. So why not just remove it from the token = solved?

This seems like a fairly simple fix. Any chance anyone can look into it? It is quite annoying issue.

I blogged about this general issue a while ago - https://hajekj.net/2017/10/30/the-dangers-of-too-many-cookies-on-a-website/

/cc: Derek Bekoe (@derekbekoe)

[b11sby]

Also having this problem :(

[SteffenHo]

I'm also experiencing this issue. When users in our organization are members of many Entra groups, dev tunnels become unusable due to HTTP 431 (Request Header Fields Too Large) errors caused by oversized cookies containing group claims.

As Jan Hajek (@hajekj) mentioned, this seems like it could be resolved by configuring the app registration to emit a groups overage claim instead of including all group memberships directly in the token. Would appreciate any update on whether this is being looked into.

[pr8x]

The real fix here is to stop putting the full claims set in the cookie. Either configure the app registration to drop the groups claim since it doesn’t look like it’s used anywhere, or if it is needed, strip it out in the token validated handler and switch to a server side ticket store so the cookie just holds a session key. Cookie chunking only delays the problem, it doesn’t solve it for users in enough groups.

This has been reopened twice now with no real movement. Would be great if someone with access to the actual service could take a look.

Closing this as unfortunately this is a known issue that there's not much Dev Tunnels can do for this today.

Derek Bekoe (@derekbekoe) This is simply false.