We're using IdentityServer4 and OpenID Connect cookie-based authentication for single sign-on across a suite of applications (10 or so) but have run into some issues. I followed the advice here Dominick Baier on issue 2662 when deciding whether there should be one clientid or many for these apps, and later he suggested that each app should have its own cookie. This has resulted in us having some pretty substantial cookies however (with each being something like 1024 bytes or so) and after authenticating with a couple of apps we hit the point where we get "Bad Request - Request Too Long" errors.
Are we doing something wrong? Should we really be bodging it so that there's only a single clientid + cookie in this case? Or perhaps we should be looking to trim the cookies themselves?
I have seen cases of too many OpenIdConnect.nonce cookies before, but this is something different.