diff --git a/CHANGELOG.md b/CHANGELOG.md
index b565a9d2aa54697a7064797754b8c8366ced9744..e7262b280b2d95c07997881d26818532ce52509a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,8 @@ All notable changes to this project are documented below.
 The format is based on [keep a changelog](http://keepachangelog.com) and this project uses [semantic versioning](http://semver.org).
 
 ## [Unreleased]
+### Fixed
+- Set gateway timeout to match idle timeout value.
 
 ## [2.3.1] - 2019-01-04
 ### Added
diff --git a/server/api.go b/server/api.go
index 096dd981c6ac8eba799f8d521573256dc528a7e5..0e19693fecaddaef58356976b6b09d0418a3c412 100644
--- a/server/api.go
+++ b/server/api.go
@@ -77,6 +77,8 @@ type ApiServer struct {
 }
 
 func StartApiServer(logger *zap.Logger, startupLogger *zap.Logger, db *sql.DB, jsonpbMarshaler *jsonpb.Marshaler, jsonpbUnmarshaler *jsonpb.Unmarshaler, config Config, socialClient *social.Client, leaderboardCache LeaderboardCache, leaderboardRankCache LeaderboardRankCache, sessionRegistry *SessionRegistry, matchRegistry MatchRegistry, matchmaker Matchmaker, tracker Tracker, router MessageRouter, pipeline *Pipeline, runtime *Runtime) *ApiServer {
+	grpcRuntime.DefaultContextTimeout = time.Duration(config.GetSocket().IdleTimeoutMs) * time.Millisecond
+
 	serverOpts := []grpc.ServerOption{
 		grpc.StatsHandler(&ocgrpc.ServerHandler{IsPublicEndpoint: true}),
 		grpc.MaxRecvMsgSize(int(config.GetSocket().MaxMessageSizeBytes)),
@@ -183,7 +185,15 @@ func StartApiServer(logger *zap.Logger, startupLogger *zap.Logger, db *sql.DB, j
 		r.Body = http.MaxBytesReader(w, r.Body, maxMessageSizeBytes)
 		handlerWithCompressResponse.ServeHTTP(w, r)
 	})
-	grpcGatewayRouter.NewRoute().Handler(handlerWithMaxBody)
+	grpcGatewayRouter.NewRoute().HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Do not allow clients to set certain headers.
+		// Currently disallowed headers:
+		// "Grpc-Timeout"
+		r.Header.Del("Grpc-Timeout")
+
+		// Allow GRPC Gateway to handle the request.
+		handlerWithMaxBody.ServeHTTP(w, r)
+	})
 
 	// Enable CORS on all requests.
 	CORSHeaders := handlers.AllowedHeaders([]string{"Authorization", "Content-Type", "User-Agent"})