title: Why is Google IAP putting double-digits request cookies in my headers?
body: <p>I have an app running on Google app engine (Flask, python 3, flexible environment) using the Identity-Aware proxy to allow everyone in our organization (which uses GSuite) to control access. Recently we've been getting 413 errors.</p>
  
  <p>When I looked at the cookies of the failing requests I expected to see one request cookie prefixed with GCP_IAAP_AUTH_TOKEN. Instead I see 11, each one slightly different. Their combined sizes put us over the 15kb header size limit indicated in the link below, causing a 413 error.</p>
  
  <p><a href="https://cloud.google.com/appengine/docs/flexible/go/how-requests-are-handled" rel="nofollow noreferrer">https://cloud.google.com/appengine/docs/flexible/go/how-requests-are-handled</a></p>
  
  <p>I don't understand why there are so many cookies, or how to make them go away. Our users all use Chrome, and many but not all of them are intermittently running into this error. Those that aren't, when their cookies are inspected, show only a couple cookies with this prefix. See below for an example of what this collection of cookies looks like:</p>
  
  <p><a href="https://i.stack.imgur.com/FVKwf.png" rel="nofollow noreferrer">Eleven IAP cookies in a single header</a></p>