Request Header Fields Too Large

Overview

431 Request Header Fields Too Large means the request headers exceed the size the server allows, either individually or collectively. The usual culprits are oversized cookies and bloated Authorization or custom headers.

Many servers cap the buffer that holds all headers (often 8-16 KB). When a session accumulates too much data into a cookie, or many third-party cookies pile up, that limit is exceeded and 431 is returned.

When it happens

• Accumulated cookies push the total header size over the server limit
• A very long JWT/token is carried in the Authorization header
• A custom header or Referer is excessively long

Request / Response example

GET /dashboard HTTP/1.1
Host: app.example.com
Cookie: session=...<50 KB of cookies>...
Authorization: Bearer <very long token>

HTTP/1.1 431 Request Header Fields Too Large
Content-Type: text/plain

One or more header fields exceed the allowed size.

In code

# Raise buffers that hold large headers/cookies (or reduce cookie size instead)
server {
  large_client_header_buffers 4 32k;
}

# See exactly which headers are being sent (look for bloated Cookie)
curl -v https://app.example.com/dashboard 2>&1 | grep -i '^> '

Notes

• 431 can reproduce only on certain URLs because of cookies accumulated on that domain; opening the site in incognito mode quickly isolates the cause.
• It differs from 413 Content Too Large in that the problem is the headers, not the body.

Related status codes

Related headers

Specification