Skip to content

463 X-Forwarded-For Too Long

AWS load balancer code for a request whose X-Forwarded-For header contains more than 30 addresses.

Status

HTTP/1.1 463 X-Forwarded-For Too Long

Details

  • Category: 4xx
  • Status: Unofficial (AWS Elastic Load Balancing). Not registered with IANA. A server, framework, or CDN convention.
  • Specification: none, not defined by any RFC
  • Cacheable: Not cacheable
  • Response body: Allowed
  • Retry: Retry only after changing the request

An AWS Application Load Balancer rejects a request with 463 when the X-Forwarded-For header lists more than 30 IP addresses. A chain that long normally means a proxy loop or a header being appended repeatedly.

The fix is almost always upstream: find the hop that keeps adding to the header rather than raising a limit.

Common causes

  • A proxy loop appending an address on every pass.
  • A long chain of nested proxies or CDNs, each adding a hop.
  • A client sending a spoofed X-Forwarded-For with many entries.

How to fix it

As the client

  • Do not send your own X-Forwarded-For. Let the infrastructure populate it.
  • Flatten the proxy chain so a request passes through fewer hops.

As the server

  • Strip or normalize inbound X-Forwarded-For at the edge instead of appending blindly.
  • Look for routing loops where traffic re-enters the same load balancer.

Examples

An X-Forwarded-For chain from a proxy loop

HTTP request

GET /api/status HTTP/1.1
Host: api.example.com
X-Forwarded-For: (31 addresses)

HTTP response

HTTP/1.1 463

See also