Yes, this is a real problem, tokens can get very large if you put too much information. HTTP does not define any limit for headers, but most of the Web Servers

Yes, this is a real problem, tokens can get very large if you put too much information. HTTP does not define any limit for headers, but most of the Web Servers have a default limit, Apache 8kb, IIS 16kb, nginx 4kb (see this question on SO [1]). If your JWT exceeds these limits you will get a "413 Entity Too Large". It gets only worse if you need to use a query string instead of a header because the limits are lower and IE has a limit too [2]. Solution: carefully design your JWT, what information you will put on there. You usually don't need everything, store only the things you will use on every request, like the user id, name, email, roles are good candidates. Do not try to put the entire Facebook or Linkedin profile on a JWT. Beside the limits, it will make the request bigger to transport and maybe even slower to verify. [1]: http://stackoverflow.com/questions/686217/maximum-on-http-header-values http://stackoverflow.com/questions/686217/maximum-on-http-he... [2]: http://stackoverflow.com/questions/417142/what-is-the-maximum-length-of-a-url-in-different-browsers http://stackoverflow.com/questions/417142/what-is-the-maximu...