[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eIdentity-Aware Proxy (IAP) can secure apps in App Engine, Compute Engine, Google Kubernetes Engine, and Cloud Run, but not Cloud CDN.\u003c/p\u003e\n"],["\u003cp\u003eIf requests to your IAP-secured resources fail with a 405 error, ensure cookies are attached to your requests using methods like \u003ccode\u003ewithCredentials\u003c/code\u003e or the \u003ccode\u003ecredentials\u003c/code\u003e option.\u003c/p\u003e\n"],["\u003cp\u003eFor HTTP 302 redirects instead of 401 errors, the header of your request should include \u003ccode\u003eHTTP Accept="text/html,*/*"\u003c/code\u003e, indicating the client can handle redirects, and POST requests will not trigger redirects.\u003c/p\u003e\n"],["\u003cp\u003eIAP for TCP uses the domains \u003ccode\u003etunnel.cloudproxy.app\u003c/code\u003e and \u003ccode\u003emtls.tunnel.cloudproxy.app\u003c/code\u003e, so proxy servers and firewalls must allow traffic to these domains, and blocking traffic to these domains will prevent the usage of IAP for TCP.\u003c/p\u003e\n"],["\u003cp\u003eIf your application receives error code 429, it indicates that IAP is throttling traffic because you've exceeded 360,000 requests per minute per project, and to resolve it, you can consider implementing exponential backoff, moving applications to different projects, using API gateway solutions, or requesting a quota limit increase.\u003c/p\u003e\n"]]],[],null,["# Frequently asked questions and troubleshooting\n\nThis document contains frequently asked questions about Identity-Aware Proxy (IAP).\n\nWhat apps can I secure with IAP?\n--------------------------------\n\nIAP can be used with the following:\n\n- App Engine standard environment and App Engine flexible environment apps\n- Compute Engine instances with HTTP(S) load balancing backend services\n- Google Kubernetes Engine containers\n- Cloud Run apps with HTTP(S) load balancing backend services\n- [Cloud Run with one click](/run/docs/securing/identity-aware-proxy-cloud-run) and no load balancing backend services\n\nIAP *cannot* be used with [Cloud CDN](/cdn/docs).\n\nWhy is there a # at the end of my URL after signing in to my app?\n-----------------------------------------------------------------\n\nIn some browsers and under certain conditions, a `#` may be appended to the URL\nafter authentication. This is normal and won't cause issues when logging in.\n\nWhy are my requests failing and returning `405 Method Not Allowed`?\n-------------------------------------------------------------------\n\nThis typically happens when cookies aren't attached to your requests. JavaScript\nmethods don't attach cookies by default.\n\nDifferent request methods require different approaches:\n\n- For [`XMLHttpRequest`](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials), set `withCredentials` to `true`\n- For the [Fetch\n API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch#Sending_a_request_with_credentials_included), set `credentials` to `include` or `same-origin`\n\nFor handling session-related errors, see [Managing IAP\nsessions](/iap/docs/sessions-howto).\n\nWhy am I receiving an `HTTP 401 Unauthorized` instead of a `302 Redirect`?\n--------------------------------------------------------------------------\n\nIAP sends a `302 Redirect` only when your client is configured to\nhandle redirects.\n\nAdd `HTTP Accept=\"text/html,*/*\"` to your request headers to indicate support\nfor redirects.\n\nWhy aren't POST requests triggering redirects?\n----------------------------------------------\n\nBrowsers don't redirect in response to POST requests. Instead,\nIAP returns a `401 Unauthorized` status code.\n\nFor POST requests to IAP-secured resources, include either of the following:\n\n- An ID token in an `Authorization: Bearer` header\n- Valid cookies (see [refreshing\n sessions](/iap/docs/sessions-howto#expired_session_responses))\n\nCan I use IAP if I have disabled the API?\n-----------------------------------------\n\nYes, resources secured by IAP remain accessible when the API\nis disabled, but you won't be able to modify IAM permissions.\n\nHow can I prevent users with the Owner role from using IAP for TCP?\n-------------------------------------------------------------------\n\nIdeally, limit use of the Owner (`roles/owner`) role in favor of more granular\npermissions. See [IAM best\npractices](/iam/docs/using-iam-securely) for guidance.\n\nIf that's not possible, you can block IAP for TCP using\n[Firewall rules](/vpc/docs/firewalls).\n\nWhat domain does IAP for TCP use?\n---------------------------------\n\nIAP uses the following Google-owned domains:\n\n- `tunnel.cloudproxy.app`\n- `mtls.tunnel.cloudproxy.app` (when [certificate-based access](/chrome-enterprise-premium/docs/securing-resources-with-certificate-based-access) is enabled)\n\n| **Caution:** Ensure that your proxy servers and firewalls allow traffic to these domains and don't block WebSocket connections.\n\nWhy am I receiving `Server Error`?\n----------------------------------\n\nIf you see: \n\n The server encountered a temporary error and could not complete your request. Please try again in 30 seconds.\n\nIt's possible that your firewall may be blocking the load balancer IPs.\n\nCheck that your firewall allows traffic from `130.211.0.0/22` and\n`35.191.0.0/16`. If these IPs can't reach your backend, your applications will\nbe inaccessible.\n\nFor IAP TCP connections to specific VMs, also ensure the VM\naccepts connections from the `35.235.240.0/20` range.\n\nWhy am I receiving intermittent internal server errors?\n-------------------------------------------------------\n\nMessages like `An internal server error occurred while authorizing your request.\nError code X` indicate backend failures.\n\nError codes `1`, `30`, `62`, `63`, `64`, or `703` typically reflect transient\nissues. Implement exponential backoff for retries.\n\nHow can I address quota exceeded errors (Error code 429)?\n---------------------------------------------------------\n\nError code 429 occurs when your application exceeds IAP's\nrequest limits. The service enforces separate quotas:\n\n- **Browser-based requests:** 360,000 per minute per project\n- **Programmatic requests:** 360,000 per minute per project\n\nA programmatic request is one that includes an `AUTHORIZATION` or\n`PROXY-AUTHORIZATION` header and no IAP cookie. All other requests (including\nthose with no credentials) are considered browser requests.\n\nThese limits apply collectively to all IAP-protected\nresources in your project.\n\nIf you're experiencing quota-related errors, consider these solutions:\n\n- Avoid load testing in production - use alternative network paths that bypass IAP\n- For service-to-service traffic, implement exponential backoff to handle 429 errors gracefully\n- Distribute high-traffic applications across multiple projects\n- Use Apigee or similar API gateway solutions for API-based applications\n- Contact [Google Cloud Support](/support) for quota increases if organic growth is causing the issue\n\nError codes\n-----------\n\nThe following table lists common error codes and messages that return when\nconfiguring and using IAP.\n\nIf you're unable to resolve your issue, or you don't see your error listed on\nthis page, then contact Cloud Customer Care with a description of the error and the\nresponse you get from a `GET` call to the API. Ensure that you remove your\nclient secret from the response."]]
