Intermediate LevelAuthentication & Authorization
How do you enrich JWT payloads with custom authorization claims without bloating token size?
❓ Interview Prompt: Explain custom claims in JWT payloads, namespace conventions, HTTP header size limits, and claims pruning.
Adding custom authorization claims (tenant IDs, org roles, feature flags) directly to JWT payloads allows downstream microservices to authorize requests without database calls.
Rules for Custom Claims:
1
Namespace Custom Claims: Use URI namespaces (e.g. '"https://company.com/roles"') to avoid collisions with standard RFC 7519 registered claims.
2
Prevent Token Bloat: HTTP servers enforce maximum header limits (e.g. 8KB to 16KB). Avoid stuffing large arrays or full permission trees into JWTs!
3
Use Reference Identifiers: Store role IDs (e.g. '"role": "editor"') rather than expanding 50 atomic permission strings inside the payload.
Code Implementation Example
typescript
// Enriching JWT with custom namespaced claims
const customJwtPayload = {
iss: 'https://auth.company.com',
sub: 'usr_1042',
'https://company.com/tenant_id': 'tenant_acme_corp',
'https://company.com/roles': ['admin', 'billing_manager']
};💡Enriching JWT payload with URI-namespaced custom claims.
🎯 Interview Key Takeaway
Use URI namespaces for custom JWT claims and store role references to keep tokens below HTTP header size limits.
#Custom Claims#JWT#Token Bloat#Namespaces#Intermediate
Back to all Authentication & Authorization Questions→