HTTP 431 Request Header Fields Too Large: why it happens and how to fix it
The page worked yesterday, and now the server refuses every request with 431, or nginx says “Request Header Or Cookie Too Large”. The request itself is too big before your app even sees it, and cookies are almost always why.
What 431 means
Status 431 Request Header Fields Too Large means the server read your request line and headers and gave up because they were bigger than its limit. It can be the total size of all headers or one single header that is too long. Your application code never runs, so there is nothing in your app logs. Some servers use a different code for the same problem: nginx returns 400 Bad Request: Request Header Or Cookie Too Large, older Node versions closed the connection with HPE_HEADER_OVERFLOW, and some proxies send 413 or 502.
Typical limits
| Server | Default limit | Setting |
|---|---|---|
| Node.js (http) | 16 KB total | --max-http-header-size or http.createServer({ maxHeaderSize }) |
| nginx | 1 KB buffer, then 4 × 8 KB; one header line must fit in one 8 KB buffer | large_client_header_buffers 4 16k; |
| Apache | 8,190 bytes per header line | LimitRequestFieldSize |
| Gunicorn / Uvicorn | 8,190 bytes per line, 100 headers | --limit-request-field_size |
| CDNs and load balancers | Often 8–32 KB total and you can't change it | Fix the size instead |
Browsers also cap cookies at about 4,096 bytes each and a limited number per domain, but they happily send all the cookies they have, so many medium-sized cookies can still blow past an 8 KB server limit.
Why the headers got so big
- Cookies piling up. Analytics, A/B tests and chat widgets each set their own cookies on
.example.com, so every subdomain, including your API, receives all of them. - Data in cookies. A whole user profile, cart or a large JWT stored in a cookie. Session libraries that keep data in the cookie (cookie sessions) grow as you add fields.
- Chunked cookies. Auth libraries split a large token into
session.0,session.1, … to dodge the 4 KB cookie limit, which just moves the problem to the server limit. - Duplicates. The same cookie name set on both
example.comand.example.com, or on several paths, so the browser sends it twice. - Long localhost history. Every project you've run on
localhostshares its cookies, whatever the port. That's why 431 shows up in local development so often. - Big Referer or Authorization headers. A huge query string, or a bearer token stuffed with claims.
Fix it as a visitor
Clear cookies for the site (in Chrome: the icon left of the address, then Cookies and site data), or try a private window. If a private window works, it's cookies. On localhost, clearing cookies for localhost fixes the problem for every port at once.
Fix it as the site owner
- Measure. In DevTools, open the failing request, copy the
Cookierequest header and paste it into the Set-Cookie explainer in Cookie-header mode. It lists each cookie with its size and flags duplicate names. The free Anvil cookie API does the same from a script. - Store an ID, not data. Keep a short random session ID in the cookie and the data on the server. If you must use a JWT, keep its claims small; decode it with the JWT decoder to see what's in it.
- Scope cookies tightly. Leave out
Domainto make a cookie host-only so it isn't sent to every subdomain, and set a narrowPathwhere it makes sense. Serve your API or static files from a separate host that doesn't receive the main site's cookies. - Delete stale cookies. Expire old names explicitly with
Max-Age=0and the same Path and Domain they were set with, or the delete won't match. - Then raise limits a little, consistently on every hop (CDN, load balancer, nginx, app). Raising one hop just moves the error to the next.
# nginx: allow header lines up to 16 KB
large_client_header_buffers 4 16k;
# Node.js
node --max-http-header-size=32768 server.jsRelated
Why is my cookie not being set? · localStorage vs cookies · Decoding JWTs safely · 502 Bad Gateway · Anvil HTTP status API · Wirebook /codes
Questions
How do I fix 431 Request Header Fields Too Large in Chrome?
Clear the cookies for that site, or open it in a private window. If that works, the site is sending too many or too-large cookies.
Why do I get 431 on localhost?
Cookies for localhost are shared across every port, so cookies from all your local projects are sent with each request. Clear localhost cookies.
What is the header size limit in Node.js?
16 KB for all headers by default. You can raise it with --max-http-header-size or the maxHeaderSize option, but shrinking cookies is the better fix.
Is 431 the same as nginx's 400 Request Header Or Cookie Too Large?
Yes, it's the same problem. nginx reports it as a 400 with that message; raise large_client_header_buffers or send fewer cookie bytes.
Can one cookie be bigger than 4 KB?
No. Browsers drop a cookie whose name plus value is over about 4,096 bytes, which is why libraries split big tokens into several cookies.
Published .