{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1845","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1845/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1845/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1845/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1845","id":105189237,"number":1845,"title":"id_token_hint too long on Logout","user":{"login":"NigeB","id":14160597,"avatar_url":"https://avatars.githubusercontent.com/u/14160597?v=3","gravatar_id":"","url":"https://api.github.com/users/NigeB","html_url":"https://github.com/NigeB","followers_url":"https://api.github.com/users/NigeB/followers","following_url":"https://api.github.com/users/NigeB/following{/other_user}","gists_url":"https://api.github.com/users/NigeB/gists{/gist_id}","starred_url":"https://api.github.com/users/NigeB/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NigeB/subscriptions","organizations_url":"https://api.github.com/users/NigeB/orgs","repos_url":"https://api.github.com/users/NigeB/repos","events_url":"https://api.github.com/users/NigeB/events{/privacy}","received_events_url":"https://api.github.com/users/NigeB/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-09-07T10:18:48Z","updated_at":"2015-09-09T15:19:18Z","closed_at":null,"body":"Hi Brock.\r\nWe've implemented IdentityServer with MembershipReboot and it's working great (you seem to be just about the only people doing this stuff! - Congratulations!).\r\n\r\nHowever, I've come across a problem with the id_token_hint being too long on Logout - As soon as the user gets a dozen or so claims in their profile, the id_token gets very large (about 3k!) - too long to pass in a query string to the Logout endpoint.\r\n\r\nThis seems to be a problem with the protocol, rather than IdentityServer itself, but I was wondering if I'm not understanding something correctly - I've looked all over the web, but everything seems to point to additional (custom) user claims always being in the id_token, and since the server has issued the token, I can't meddle with it to try and shorten it without invalidating it.\r\n\r\nAm I correct - Is there anything I can do?\r\n\r\nMany thanks for the great work - I'd have been stuffed without it! "},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/138944250","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1845#issuecomment-138944250","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1845","id":138944250,"user":{"login":"brockallen","id":649492,"avatar_url":"https://avatars.githubusercontent.com/u/649492?v=3","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"created_at":"2015-09-09T15:19:18Z","updated_at":"2015-09-09T15:19:18Z","body":"If you don't want claims in the id_token, then don't set `alwaysInclude` on the `ScopeClaim` config. You'd then need to use the access token to hit the user profile endpoint. All that config is covered in the docs."}}