HTTP 431 Request Header Fields Too Large: Cookie and Header Fixes

A 431 means the server refuses the request because its header fields, either one header or all of them together, are too large. It was added in RFC 6585. The most common culprit is the Cookie header, which grows silently as sites add tracking, sessions and preferences. See the HTTP 431 reference.

Not every server uses 431. nginx, for example, usually answers a too-large cookie with a 400 page that reads "Request Header Or Cookie Too Large", so the same underlying problem may appear as 400 Bad Request. Whichever status you get, the fix path is the same.

If you are a visitor

1. Clear cookies and site data for that site only. In Chrome, open Settings, Privacy, Site settings, View permissions and data stored across sites, search for the domain and delete it. This fixes most cases instantly.
2. Try a private window. A fresh window sends no old cookies. If it works, you have confirmed the cause.
3. Log out and back in after clearing, since sessions rebuild with a small cookie.
4. Disable extensions that add headers or store large data in cookies.
5. Contact the owner if the error returns within days. Their site is probably setting too many or too large cookies.

If you own the site

1. Find out how big the headers actually are

Capture the real request in your browser's developer tools (Network tab, look at Request Headers) and measure the Cookie header. You can also see what your server sets with the Cookie Checker and the HTTP Header Checker.

curl -s -o /dev/null -D - https://example.com/ | grep -i '^set-cookie'

A single header over roughly 4 KB is already a warning, because many browsers cap cookie size at about 4096 bytes per cookie, and servers commonly cap total header size near 8 to 16 KB.

2. Cookie bloat from your own app

Typical causes:

• Storing user data, carts or whole objects in cookies instead of a server-side session.
• Cookies set on the parent domain (.example.com) that every subdomain sends on every request, including static assets.
• Multiplying analytics, A/B and consent cookies that never expire.
• A bug that adds a new cookie with a unique name on each visit.

Fix by storing a short session ID in the cookie and the data on the server, scoping cookies to the host that needs them, setting expirations and deleting stale names. Read cookie flags explained for scope and flags.

3. Raise nginx limits if the traffic is legitimate

large_client_header_buffers 4 16k;

The default is 4 8k. The request line and each header field must fit in one buffer. Reload with sudo nginx -t && sudo systemctl reload nginx. Entries in the error log read client sent too long header line or client intended to send too large body for related limits.

4. Apache

LimitRequestFieldSize 16384
LimitRequestFields 100

LimitRequestFieldSize defaults to 8190 bytes, and LimitRequestFields defaults to 100. Set them in the main or virtual host config, then restart Apache.

5. Application servers and proxies

Node.js rejects oversized headers with 431 and a default total limit of 16 KiB in current versions; the --max-http-header-size option or the maxHeaderSize server option adjusts it. Tomcat has maxHttpHeaderSize, and Kestrel in ASP.NET Core has MaxRequestHeadersTotalSize. Load balancers and CDNs also publish limits you cannot always raise, so reduce the headers rather than hoping. Check who is in front using the CDN डिटेक्टर.

6. Large auth headers

JWT bearer tokens that carry many claims or group memberships produce huge Authorization headers. Keep tokens small, move rarely needed data to a lookup, or use opaque tokens and look up details server-side. Decoding your own tokens in the JWT डिकोडर shows how much they carry.

Verify

After trimming or raising limits, reproduce with a large cookie:

curl -s -o /dev/null -w "%{http_code}\n" -H "Cookie: a=$(head -c 12000 /dev/zero | tr '\0' x)" https://example.com/

A response above your limit should be 431 or 400, and normal sizes should return 200. Check ordinary requests with the HTTP स्टेटस चेकर, run the वेबसाइट हेल्थ चेक, and keep an अपटाइम मॉनिटर on the home page.

अगले कदम

• Read the HTTP 431 reference.
• Compare with 414 URI Too Long.
• Review cookie flags and scope.
• Inspect headers using the HTTP Header Checker.

सामान्य प्रश्न

What is the difference between 431 and 414?

431 is about header fields, usually cookies. 414 is about the URL on the request line. Both are size limits at the start of the request.

Why does clearing cookies fix it?

Cookies are sent with every request. Deleting them shrinks the header back under the server limit.

What is a safe cookie size?

Keep individual cookies under about 4 KB and total headers well under 8 KB, so even strict servers accept them.

Can a CDN return 431 before my server sees the request?

Yes. Its limits apply first, so test through and around the CDN to see which layer rejects it.

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.