title: How to pass cookies when calling authentication enabled aws application loadbalancer
body: <p>I have done following configurations</p>
  <ol>
  <li>Created loadbalancer</li>
  <li>Created user pool</li>
  <li>created client with secret and enabled authorization code grant and openid scope</li>
  </ol>
  <p>Configured authentication in loadbalancer with above created resource details</p>
  <ol start="4">
  <li>Created a listener rule with cognito authentication</li>
  <li>Added needed configuration including scope as <code>openid</code></li>
  <li>Configured <code>deny</code> for unauthenticated requests</li>
  </ol>
  <p>Problem is when I call the loadbalancer url with the id token or access token(as cookies) that is retrieved from another app client configured to application, The loadbalancer is returning 401</p>
  <p>When I try the the configuration <code>authenticate</code> for unauthenticated request. I was able to successfully call the loadbalancer url where I am getting success response(loadbalancer will redirect to cognito login and after successfull login, loadbalancer will set the cookies).</p>
  <p>The cookie that being set in the success scenario is being sharded</p>
  <p>The cookie entry were like <code>cookie_name-0</code> and <code>cookie_name-1</code> (Which I do not know how to reproduce/recreate manually)</p>
  <p>The below excerpt from aws docs confirms above sharding behaviour</p>
  <blockquote>
  <p>The load balancer creates the authentication session cookie and sends it to the client so that the client's user agent can send the cookie to the load balancer when making requests. Because most browsers limit a cookie to 4K in size, the load balancer shards a cookie that is greater than 4K in size into multiple cookies. If the total size of the user claims and access token received from the IdP is greater than 11K bytes in size, the load balancer returns an HTTP 500 error to the client and increments the ELBAuthUserClaimsSizeExceeded metric.</p>
  </blockquote>
  <ol>
  <li>How can I successfully call the loadbalancer url with the configuration for unauthenticated request as <code>deny</code> where I need to set the cookie manually?</li>
  <li>Manually generated id token/ access token length are around 1k in size, why the loadbalancer retrieved token exceeds 4k in size?</li>
  </ol>
  <p>Reference - <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html#authentication-flow" rel="noreferrer">https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html#authentication-flow</a></p>
  <p><a href="https://aws.amazon.com/premiumsupport/knowledge-center/elb-configure-authentication-alb/" rel="noreferrer">https://aws.amazon.com/premiumsupport/knowledge-center/elb-configure-authentication-alb/</a></p>