I need to know the maximum length of JSON Web Token (JWT).
There is no information about it in the specs. Are there are no limitations in length?
I've also been trying to find this.
I'd say - try and ensure it's below 7kb.
Whilst JWT defines no upper limit in the spec (http://www.rfc-editor.org/rfc/rfc7519.txt) we do have some operational limits. As a JWT is included in a HTTP header, we've an upper limit (SO: Maximum on http header values) of 8K on the majority of current servers.
As this includes all Request headers < 8kb, with 7kb giving a reasonable amount of room for other headers. The biggest risk to that limit would be cookies (sent in headers and can get large).
As it's encrypted and base64ed there's at least 33% wastage of the original json string, so do check the length of the final encrypted token.
One final point - proxies and other network appliances may apply an abitrary limit along the way...
As you said, there is no maximum length defined in the RFC7519 (https://www.rfc-editor.org/rfc/rfc7519) or other RFCs related to JWS or JWE.
If you use the JSON Serialized format or JSON Flattened Serialized format, there is no limitation and there is no reason to define a limitation.
But if you use the JSON Compact Serialized format (most common format), you have to keep in mind that it should be as short as possible because it is mainly used in a web context. A 4kb JWT is something that you should avoid.
Take care to store only useful claims and header informations.
When using heroku the header will be limited at 8k. Depending of how much data are you using on jwt2 it will be reach. The request, when oversize, will not touch your node instance, heroku router will drop it before your API layer..
When processing an incoming request, a router sets up an 8KB receive buffer and begins reading the HTTP request line and request headers. Each of these can be at most 8KB in length, but together can be more than 8KB in total. Requests containing a request line or header line longer than 8KB will be dropped by the router without being dispatched.
See: Heroku Limits
There is no upper limit defined for size of JWT token. The JSON Web Token (JWT) standard (RFC 7519) does not specify a maximum token size. But this also depends on the usage as to where & how the JWT token is being used.
When used as Http header:
If the token is passed as bearer token in http header, many web servers do not allow this to be more than 8 KB. It's safe to keep it to 7 KB.
When JWT is stored in a cookie:
Browser usually supports cookies up to 4 KB, hence its better to keep that limit.
When storing in database:
We need to make sure the database column size is sufficient enough to house the token.
I have encountered the problem of using a large token & not able to use it to invoke the API either from Postman or from browser (While passing the JWT token in the http header). In that case, we had to find an alternate solution. We generated a pair of JWTs - one the full token and another a smaller version of the same but both containing same JTI value (A UUID unique to identify the token). The full token would contain lot of claims & the smaller one would contain minimal basic details. This full token would be store in Redis cache with JTI being the key. The UI will use the small token to invoke APIs. When the full token is needed on the backend, it would use the JTI received from the small token passed by UI & use the same to get the full token from Redis cache.
But, its suggested to keep the claims minimal to the need so that these kind of size related issues don't occur.