HTTP — 431 Request Header Fields Too Large

Fix HTTP 431 by reducing oversized cookies and headers and raising server header buffer limits appropriately.

intermediatedebugginghttpheaders

Symptoms

431 Request Header Fields Too Large
Requests fail only for users with large cookies
The error appears after adding many cookies or a large token
It works when cookies are cleared

Possible causes

Cookies or headers exceed the server buffer limit
A JWT stored in a cookie grew beyond typical limits
Many cookies accumulate and together exceed the limit
A proxy or server has a smaller header buffer than expected

Diagnosis steps

Measure the request header size

curl -v -b "$(cat cookies.txt)" https://host/ 2>&1 | grep -i "> " | wc -c

Interpretation

Estimating the header size shows whether it approaches a common 8KB limit.

Inspect cookie accumulation

curl -sI https://host/ | grep -i "set-cookie"

Interpretation

Many set-cookie headers indicate cookie sprawl that grows each header over time.

Check server limits

nginx -T 2>/dev/null | grep -i "large_client_header_buffers"

Interpretation

The configured buffer sizes explain the threshold at which 431 is returned.

Root cause

The request header block exceeded the server or proxy buffer limit, because cookies or headers had grown larger than the configured maximum.

Fix

Reduce header size by trimming cookies and moving large tokens out of cookies, and raise the header buffer limit modestly where the extra size is legitimate, keeping limits within safe bounds.

Verify the fix

Send the previously failing request and confirm it succeeds, and confirm affected users can authenticate and use the site.

Symptom walkthrough

Requests fail with 431 Request Header Fields Too Large, often only for certain users whose cookies have grown. Cookies accumulate over time, and a large token stored in a cookie pushes the header block past the server or proxy buffer limit. The error is a protective limit rather than a bug, so the fix is to shrink the headers or, cautiously, raise the limit. Inspect the request headers to identify which cookie or header grew oversized before changing any limit.

Fix in practice

Trim cookies, move large tokens out of cookies into a short-lived reference, and clean up cookies that are no longer needed. Where additional size is genuinely required, raise the header buffer limit modestly, since very large limits increase memory use per connection and the impact of abuse.

Verification

Send the request that previously failed and confirm it succeeds, then confirm affected users can authenticate and browse. Successful requests for those users confirm the header size is now within limits.

Diagnostic commands

Check the behavior with commands like these:

curl -v -b "$(cat cookies.txt)" https://host/ 2>&1 | grep -i "> " | wc -c
curl -sI https://host/ | grep -i "set-cookie"
nginx -T 2>/dev/null | grep -i "large_client_header_buffers"