Misdirected Request

Overview

421 Misdirected Request means the request reached a server that cannot produce a response for that scheme/authority (host) — in other words, the request was delivered to the wrong place.

The most common cause is HTTP/2 connection coalescing. Browsers reuse a single connection across hosts when the TLS certificate covers multiple domains on the same IP; if that server does not actually serve the requested host, it returns 421.

When it happens

• An HTTP/2 connection opened for one domain is reused for a request to another
• The TLS SNI and the actual request Host (:authority) disagree with the server config
• Behind a load balancer/CDN, the certificate is shared but the backend does not know the host

Request / Response example

GET /page HTTP/2
:authority: other.example.com
(reused connection whose TLS cert covers only www.example.com)

HTTP/2 421 Misdirected Request
content-type: text/plain

This server cannot produce a response for the requested authority.

In code

# Reject requests whose Host does not match a configured vhost
server {
  listen 443 ssl default_server;
  return 421;
}

# Avoid HTTP/2 connection coalescing by resolving to the right host
curl --http1.1 --resolve www.example.com:443:203.0.113.10 \
  https://www.example.com/page

Notes

• Browsers typically close the connection and retry on a fresh one when they get a 421, so users rarely notice it.
• When serving multiple domains under one (SAN) certificate, make sure every domain is handled by the same server config to avoid 421.

Related status codes

Related headers

Specification