# Keycloak Cookies are too large

**URL:** <https://forum.keycloak.org/t/keycloak-cookies-are-too-large/15872>\
**Category:** Getting advice\
**Created:** [June 7, 2022, 8:23am UTC](https://forum.keycloak.org/t/keycloak-cookies-are-too-large/15872 "2022-06-07T08:23:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![eldarj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/eldarj/32/4365_2.png) [@eldarj](https://forum.keycloak.org/u/eldarj)\
**Post date:** [June 7, 2022, 8:23am UTC](https://forum.keycloak.org/t/keycloak-cookies-are-too-large/15872/1 "2022-06-07T08:23:25Z")

</div>

I’m having an issue with Keycloak Cookies. The proxy that I have in place, is very strict and has header size limitations, basically rendering Keycloak cookies too large.

All the session ids and identity ids are all fine, and my JWT isn’t large on its own ie. doesn’t contain a bunch of roles, etc. yet all of this together results in header sizes of ~6-7KB.

In what ways can I reduce the size? What are my options?

Also, I noticed there are the “\_LEGACY” duplicates of all of these. I looked into it, but couldn’t find the reasoning behind this - except that it supposedly is needed for older browsers on macos?

What are they really, and why are they needed? Can I somehow remove these legacy cookies?

---

<div class="post-metadata">

**Author:** ![lombao](https://avatars.discourse-cdn.com/v4/letter/l/c68b51/32.png) [@lombao](https://forum.keycloak.org/u/lombao)\
**Post date:** [June 9, 2022, 4:08pm UTC](https://forum.keycloak.org/t/keycloak-cookies-are-too-large/15872/2 "2022-06-09T16:08:56Z")

</div>

If you have extended the user model with additional attributes, and/or added many groups, you might want to check the Assigned Default Client Scopes in your clients. I think the default is to add the complete “profile” of the user and this carries possibily all the attributes of the user. Perhaps instead you could use the Mappers and only map those specific attributes required in each client. I think this might help to reduce the size of the tokens, or at least, this is something I would check … in case it is worth.

---

<div class="post-metadata">

**Author:** ![eldarj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/eldarj/32/4365_2.png) [@eldarj](https://forum.keycloak.org/u/eldarj)\
**Post date:** [June 14, 2022, 7:21am UTC](https://forum.keycloak.org/t/keycloak-cookies-are-too-large/15872/3 "2022-06-14T07:21:51Z")

</div>

Thanks a lot.

Yeah, this was more or less the first thing I’ve checked out. Unfortunately, there’s already not a lot of groups, scopes, etc. or attributes contained within the JWTs, so the only thing I noticed are the \_LEGACY duplicates.

Any chance you know whether this is needed, or it can be removed?