{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/589","repository_url":"https://api.github.com/repos/aspnet/Security","labels_url":"https://api.github.com/repos/aspnet/Security/issues/589/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/589/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/589/events","html_url":"https://github.com/aspnet/Security/issues/589","id":119241173,"node_id":"MDU6SXNzdWUxMTkyNDExNzM=","number":589,"title":"More efficient Authentication ticket serialization","user":{"login":"jods4","id":3832820,"node_id":"MDQ6VXNlcjM4MzI4MjA=","avatar_url":"https://avatars2.githubusercontent.com/u/3832820?v=4","gravatar_id":"","url":"https://api.github.com/users/jods4","html_url":"https://github.com/jods4","followers_url":"https://api.github.com/users/jods4/followers","following_url":"https://api.github.com/users/jods4/following{/other_user}","gists_url":"https://api.github.com/users/jods4/gists{/gist_id}","starred_url":"https://api.github.com/users/jods4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jods4/subscriptions","organizations_url":"https://api.github.com/users/jods4/orgs","repos_url":"https://api.github.com/users/jods4/repos","events_url":"https://api.github.com/users/jods4/events{/privacy}","received_events_url":"https://api.github.com/users/jods4/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/aspnet/Security/milestones/7","html_url":"https://github.com/aspnet/Security/milestone/7","labels_url":"https://api.github.com/repos/aspnet/Security/milestones/7/labels","id":1008493,"node_id":"MDk6TWlsZXN0b25lMTAwODQ5Mw==","number":7,"title":"Backlog","description":"","creator":{"login":"muratg","id":1808428,"node_id":"MDQ6VXNlcjE4MDg0Mjg=","avatar_url":"https://avatars3.githubusercontent.com/u/1808428?v=4","gravatar_id":"","url":"https://api.github.com/users/muratg","html_url":"https://github.com/muratg","followers_url":"https://api.github.com/users/muratg/followers","following_url":"https://api.github.com/users/muratg/following{/other_user}","gists_url":"https://api.github.com/users/muratg/gists{/gist_id}","starred_url":"https://api.github.com/users/muratg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/muratg/subscriptions","organizations_url":"https://api.github.com/users/muratg/orgs","repos_url":"https://api.github.com/users/muratg/repos","events_url":"https://api.github.com/users/muratg/events{/privacy}","received_events_url":"https://api.github.com/users/muratg/received_events","type":"User","site_admin":false},"open_issues":31,"closed_issues":30,"state":"open","created_at":"2015-03-06T00:23:47Z","updated_at":"2018-09-27T21:37:16Z","due_on":null,"closed_at":null},"comments":15,"created_at":"2015-11-27T19:58:05Z","updated_at":"2018-09-27T21:37:16Z","closed_at":"2018-09-27T21:37:16Z","author_association":"NONE","body":"Serialized auth tickets can grow fairly large very quickly, even in basic scenarios. If you have moderately many roles, they all get serialized with the long claim type name and that's how your tickets becomes several Ko in size before you even know it.\n\nIn the common scenario where a ticket has a few of roles, today each one is adding more than 60 bytes just for its name (unencoded, actually more than that after encryption and encoding in base64). Having roles counted in tens results in cookies of size in thousands.\n\nPreviously the payload was compressed, but because of security concerns this was removed.\n\nI noticed that in the beta-8 or rc-1 timeframe cookies chunking was added. That's a very good thing because it prevents failures caused by too large cookies. But it's not enough, because even if they don't fail, 10Ko cookies are not great for perf.\n\nI know your guideline for very large tickets is to keep them on the server in session state. It's nice to have a solution to support scenarios where there is no way you could decently round-trip your state. But when you have a stateless server, you would like to keep it that way as much as possible as it is a lot simpler and safer.\n\nWith a more efficient serialization format, common auth. tickets could be a lot smaller and not require session state. I hope you'll pursue this option in addition to what has already been done.\n\nHere's a simple suggestion: serialize claims grouped by claim type, so that you only have to serialize each claim type name only once. Something like this (pseudo-format):\n\n```\nhttp://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\n1\njods\nhttp://schemas.microsoft.com/ws/2008/06/identity/claims/role\n2\nAdmin\nPowerUser\n```\n\n(Nitpicker corner: I know some claim types are multi-values, so it's more something like this: `Roles 2 1 Admin 1 PowerUser`, etc. But you get the idea.)\n"},"comment":{"url":"https://api.github.com/repos/aspnet/Security/issues/comments/425251193","html_url":"https://github.com/aspnet/Security/issues/589#issuecomment-425251193","issue_url":"https://api.github.com/repos/aspnet/Security/issues/589","id":425251193,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNTI1MTE5Mw==","user":{"login":"Eilon","id":202643,"node_id":"MDQ6VXNlcjIwMjY0Mw==","avatar_url":"https://avatars3.githubusercontent.com/u/202643?v=4","gravatar_id":"","url":"https://api.github.com/users/Eilon","html_url":"https://github.com/Eilon","followers_url":"https://api.github.com/users/Eilon/followers","following_url":"https://api.github.com/users/Eilon/following{/other_user}","gists_url":"https://api.github.com/users/Eilon/gists{/gist_id}","starred_url":"https://api.github.com/users/Eilon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Eilon/subscriptions","organizations_url":"https://api.github.com/users/Eilon/orgs","repos_url":"https://api.github.com/users/Eilon/repos","events_url":"https://api.github.com/users/Eilon/events{/privacy}","received_events_url":"https://api.github.com/users/Eilon/received_events","type":"User","site_admin":false},"created_at":"2018-09-27T21:37:16Z","updated_at":"2018-09-27T21:37:16Z","author_association":"MEMBER","body":"Closing because no further action is planned on this issue."}}
{"actor":{"display_login":"Eilon"}}