431 Error

A 431 Request Header Fields Too Large error is a webserver’s code for:

“Your request headers—usually cookies or authorization tokens—are too big for me to process.”

A 431 Request Header Fields Too Large error indicates that the server refuses to process the request because either an individual header field or all header fields collectively are too large.

Webservers allocate memory buffers (typically 8 KB to 32 KB) to read incoming HTTP request headers. When bloated cookies, massive authentication tokens, or long URLs exceed these buffers, the server safely aborts with a 431 code.

Determining why

  • Cookie bloat - Months of tracking, session, and analytics cookies have piled up for the domain.
  • Oversized authorization tokens - An OAuth or JWT bearer token contains too many claims or permissions to fit in standard HTTP buffers.
  • Excessive query parameters - Custom headers or user-agent strings are abnormally long.

Steps you could possibly take:

  • Clear cookies for the domain - In your browser settings, delete cookies and site data for the website you are trying to visit. This resolves the issue in 95% of cases.
  • Try Incognito mode - A private browsing window starts with zero cookies, immediately confirming if cookie bloat was the culprit.
  • If you are the website administrator or developer:
    • Reduce cookie sizes and avoid storing large JSON blobs in cookies.
    • In nginx, increase the buffer size using large_client_header_buffers 4 16k;.
    • In Apache, adjust LimitRequestFieldSize and LimitRequestFields.

Source: RFC 6585 Section 5 (Additional HTTP Status Codes)