Hacker News Reader

Cosign. AAD ID tokens had the same issue, and we'd see tokens with 1500+ guids shoved in there for the group ids. We had (and have) a nasty "too many, go call this API you need a new permission for" outcome there.

Right next to those customers were the ones demanding our tokens always be an exact number of bytes (yeah. Really).

View on HN

Ha, I dealt with some of those.

The other challenge was customers who wanted groups to show up in a particular order. Since it's was literally just an array (no keys), it was just a giant alphabetized list.

Then the problem came when people used group count limits. Your group "AppDev" was always fine but "TestGroup7" may not be.. depending on how many groups the user was in and/or how they filtered those groups.

Figuring out that one out was terrible.

Reply on news.ycombinator.com