Java Servlet中压缩存储JWT到Cookie解决431请求头过大问题

Great question! Dealing with 431 errors from oversized cookies is super common when working with JWTs, especially refresh tokens that can get bulky. Here's a practical, Java-based solution to compress your refresh_token before storing it in a cookie, then decompress it when you need to use it:

First, build a reusable utility to handle GZIP compression and Base64 encoding (since cookies can't store raw binary data):

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.util.Base64;
import java.util.zip.GZIPInputStream;
import java.util.zip.GZIPOutputStream;

public class TokenCompressionUtils {

    // Compress refresh token and encode to URL-safe Base64
    public static String compressToken(String rawToken) throws IOException {
        if (rawToken == null || rawToken.isBlank()) {
            return rawToken;
        }

        ByteArrayOutputStream byteStream = new ByteArrayOutputStream();
        try (GZIPOutputStream gzipStream = new GZIPOutputStream(byteStream)) {
            gzipStream.write(rawToken.getBytes("UTF-8"));
        }
        return Base64.getUrlEncoder().encodeToString(byteStream.toByteArray());
    }

    // Decompress Base64-encoded token back to original string
    public static String decompressToken(String compressedToken) throws IOException {
        if (compressedToken == null || compressedToken.isBlank()) {
            return compressedToken;
        }

        byte[] compressedBytes = Base64.getUrlDecoder().decode(compressedToken);
        ByteArrayInputStream byteStream = new ByteArrayInputStream(compressedBytes);
        ByteArrayOutputStream outputStream = new ByteArrayOutputStream();

        try (GZIPInputStream gzipStream = new GZIPInputStream(byteStream)) {
            byte[] buffer = new byte[1024];
            int bytesRead;
            while ((bytesRead = gzipStream.read(buffer)) != -1) {
                outputStream.write(buffer, 0, bytesRead);
            }
        }
        return outputStream.toString("UTF-8");
    }
}

When generating and sending the refresh token to the client, compress it first before adding it to the response:

// In your servlet's response logic
String originalRefreshToken = "your-generated-refresh-token";

try {
    String compressedRefreshToken = TokenCompressionUtils.compressToken(originalRefreshToken);
    
    Cookie refreshTokenCookie = new Cookie("refresh_token", compressedRefreshToken);
    // Configure secure cookie attributes
    refreshTokenCookie.setHttpOnly(true);
    refreshTokenCookie.setSecure(true); // Enable only if using HTTPS
    refreshTokenCookie.setPath("/");
    refreshTokenCookie.setMaxAge(7 * 24 * 60 * 60); // 7-day expiration example
    
    response.addCookie(refreshTokenCookie);
} catch (IOException e) {
    // Handle compression failure - e.g., log error, fall back to uncompressed or redirect to login
    e.printStackTrace();
}

When you need to use the refresh token (e.g., for token renewal), pull it from the cookie and decompress it:

// In your servlet's request handling logic
String compressedRefreshToken = null;
Cookie[] cookies = request.getCookies();

if (cookies != null) {
    for (Cookie cookie : cookies) {
        if ("refresh_token".equals(cookie.getName())) {
            compressedRefreshToken = cookie.getValue();
            break;
        }
    }
}

if (compressedRefreshToken != null) {
    try {
        String originalRefreshToken = TokenCompressionUtils.decompressToken(compressedRefreshToken);
        // Use the original token for your refresh logic here
    } catch (IOException e) {
        // Handle decompression failure - e.g., invalidate cookie, redirect to login
        e.printStackTrace();
    }
}

• URL-Safe Base64: We use Base64.getUrlEncoder()/getUrlDecoder() because regular Base64 contains characters (+, /) that aren't cookie-safe. URL-safe encoding replaces these with - and _, and removes padding =.
• Error Handling: Always wrap compression/decompression in try-catch blocks. If something fails, invalidate the cookie and prompt the user to re-authenticate.
• Compression Efficiency: JWTs are text-heavy, so GZIP typically cuts their size by 50% or more. If you still hit 431 errors, audit your refresh token to remove unnecessary claims.
• Cookie Security: Never skip setting HttpOnly (prevents XSS access) and Secure (only sends over HTTPS) flags for authentication cookies.

内容的提问来源于stack exchange，提问作者javaTry