Is the application requesting a token a single page application using implicit mode (response_type
is token
, id_token
or token id_token
?). If so, the limit is set at 3.5 K because the response is delivered in a Location
header for the redirection to the callback URL, and some browsers limit the length of headers. There’s no way around it unless, except a change in architecture like the one you mentioned above.
If you are using an authorization code flow or hybrid flow (used in regular web apps or native applications, or if you put a back end to your SPA receive and keep the tokens using an authorization code exchange), the limit is removed because the browser does not limit these exchanges.