431 Request Header Fields Too Large
The request's headers exceed the size the server is willing to accept.
What 431 means
431 says the headers, individually or collectively, are too big. It exists so that this specific failure is distinguishable from a general 400, though many servers still return 400 or simply drop the connection instead.
In practice the cause is almost always cookies. Cookies are sent on every request to their domain, they accumulate, and once the total exceeds the server's header limit - commonly 8KB in nginx and Apache, 16KB in some Node configurations - every request from that browser fails until the cookies are cleared. The symptom is distinctive: the site is broken for one user and fine for everyone else, and clearing cookies fixes it.
Long Referer headers, oversized Authorization headers carrying a bloated JWT, and accumulated tracking cookies from third-party scripts are the other regulars.
Common causes of a 431
- Accumulated cookies for the domain exceeding the server's header limit - by far the most common cause.
- A JWT with too many claims in the Authorization header.
- A very long Referer or a URL with a large query string reflected into a header.
- Many small cookies set by analytics and tag-manager scripts over time.
- A proxy adding forwarding headers that push an already-large request over the limit.
How to fix a 431
- Clear cookies for the domain - this fixes it immediately for an affected user.
- Audit what is setting cookies, and set a shorter Max-Age or scope them to a narrower path.
- Keep JWTs minimal: an identifier and the claims you actually check, not a user profile.
- Raise large_client_header_buffers in nginx as a stopgap, but treat the cause as the real fix.
- Return 431 rather than 400 so the failure is diagnosable from the client side.
Should a client retry?
The same request will fail identically. The headers must get smaller - usually by clearing cookies.
FAQ
- What usually causes a 431?
- Accumulated cookies. They are sent on every request and grow over time, and once the total exceeds the server's header buffer every request fails. The giveaway is that the site is broken for one user and clearing cookies fixes it.
- What is the header size limit?
- It is server configuration, not a specification value. nginx and Apache commonly allow around 8KB; Node's default is 16KB. Individual header limits and the total limit are often configured separately.
- Should I just raise the limit?
- As a stopgap. If cookies are growing without bound, raising the buffer only delays the failure - audit what is setting them and scope or expire them properly.
Often confused with
- 400 Bad Request The server could not understand the request - it is malformed.