Q44: What performance bottlenecks can arise from bloated JWT payloads and how do you mitigate them?
Because JWTs are transmitted on every HTTP request header (Authorization: Bearer <token>), storing bloated arrays of permissions, user profile lists, or nested groups inflates header size.
Bottlenecks:
- Exceeds maximum server header limits (HTTP 431 Header Fields Too Large).
- Consumes significant network bandwidth and increases serialization latency across microservices.
Mitigations:
- Keep JWT payloads lightweight by storing only subject IDs, tenant IDs, and top-level role keys.
- Use reference tokens (Opaque IDs) or fetch fine-grained permissions via local microservice memory caches.
Key Takeaways
- Bloated JWT payloads inflate request headers and consume bandwidth.
- Store minimal identity claims inside tokens; fetch granular permissions via backend local caches.