Skip to content

431 Request Header Fields Too Large

The request headers are collectively or individually too large for the server to process.

Status

HTTP/1.1 431 Request Header Fields Too Large

Details

  • Category: 4xx
  • Status: Standard. Registered with IANA and defined by a current standards-track RFC.
  • Specification: RFC 6585 §5
  • Cacheable: Only with explicit cache headers
  • Response body: Allowed
  • Retry: Retry only after changing the request

431 covers both cases: the whole header block exceeded the server's buffer, or one field did. Cookies are the usual offender, since they accumulate silently until a single domain sends several kilobytes on every request.

The response should say which field was the problem when it can, because a client with no idea which header is oversized has little to work with.

Common causes

  • Accumulated cookies for a domain exceeding the server's header limit.
  • A very large Authorization header, such as a JWT stuffed with claims.
  • Long Referer or custom tracking headers added by middleware.
  • A redirect loop that appends a header on each pass.

How to fix it

As the client

  • Clear cookies for the site. This resolves most browser-side 431s immediately.
  • Shrink tokens: reference server-side session state instead of embedding large claim sets.
  • Remove unnecessary custom headers from automated clients.

As the server

  • Raise header buffer limits where large headers are legitimate, for example large_client_header_buffers in nginx.
  • Keep cookies small and scoped, and avoid setting them on static asset paths.
  • Name the offending header in the response body.

Examples

A cookie header that grew too large

HTTP request

GET / HTTP/1.1
Host: www.example.com
Cookie: (12KB of accumulated cookies)

HTTP response

HTTP/1.1 431 Request Header Fields Too Large
Content-Type: text/plain

Cookie header exceeds 8192 bytes

Specifications

See also