title: ASP OpenID Connect: Bad Request, request too long
body: <p>For a website which uses OpenID Connect to authenticate to Azure, I got sometimes the message 'Bad request - Request too long. the size of the request headers is too long'. The issue now occurs on Google Chrome MF and Edge. After deleting the cookies, the site will work for one session. On restart of the browser the problem returns. I'm running version 4.0.0 of the OpenID Connect package.</p>
  
  <p>The issue is known and caused by the nonce cookies which are created by openid connect. When it shows the error, at that moment, more than 20 of those cookies exist in the browser (Chrome, Firefox and Edge). I tried different things, but still no solution.</p>
  
  <ul>
  <li>The answer from @andrew.fox at <a href="https://stackoverflow.com/questions/36795259/too-many-cookies-openidconnect-nonce-cause-error-page-bad-request-request-too">Too many cookies OpenIdConnect.nonce cause error page &quot;Bad Request - Request Too Long&quot;</a> did not change a thing.</li>
  <li>Downgrading the package to version 3.0.0 didn't solved it eiter. Extra problems due to related package which were on newer versions.</li>
  <li>Deleting old Nonce cookies as suggested in <a href="https://github.com/IdentityServer/IdentityServer3/issues/1124" rel="nofollow noreferrer">https://github.com/IdentityServer/IdentityServer3/issues/1124</a> only ends up in an infinite loop of deleting and creating cookies.</li>
  </ul>
  
  <p><strong>EDIT</strong></p>
  
  <p>When downgrading the OpenIDConnect package to version 3.0.0, the first time I open the browser (after setting published code in IIS) login is succeeded and it forwards to the correct page. When closing and reopening the browser (when user was still logged in) an infinite loop starts at login because the User.Identity.IsAuthenticated is always false even after a successful login.</p>