authservice should share both the ID token and the access token with the app about authservice

[cfryanr]

I wonder if common application libraries (e.g. Spring) would know how to interpret an Authorization header that looks like this?

Authorization: Bearer <access_token> <id_token>

Perhaps something to try.

In addition to checking common libraries, we would also need to make sure that Istio's authn jwt token checking filter also supports this.

If they do, then when the user configures both header configuration options to be the same, then perhaps the authservice could use this format instead of erroring out.

[nickrmc83]

My feeling with this one is to put each token in separate cookies and headers so that we do not have to worry about breaking the size limits of those fields.

I'm also thinking that the access token is an opt-in whilst we always include the id_token. I'm assuming that we provide the capability to define the name of both the cookie returned to the browser as well as the header that we forward the access token.

Thoughts?