When storing JWT, e.g. returned from Azure Active Directory endpoints, into cookies, web server (Tomcat) throws an exception or warning regarding limit of cookie size.
Most browsers limit the size of a cookie to 4096, including name and =. There are also limits on the number of cookies per domain. JWT is not limited in size.
- A good information regarding limtations on cookies: http://browsercookielimits.squawky.net/
The bottom line is: If you want to support most browsers, then don't exceed 50 cookies per domain, and don't exceed 4093 bytes per domain (i.e. total size of all cookies <= 4093 bytes)
Split the JWT cookie into multiple cookies.
Store the JWT into application's session storage and exchange it only through authentication header or through HTTP request parameters.
For JavaScrpt SPA, this could be the browser's local storage.