431 Request Header Fields Too Large

RFC 6585, section 5, allows 431 both for the header block as a whole and for a single field, and asks the server to say which field was too large in the latter case. Limits differ a lot between servers. Node.js rejects headers over 16 KB by default and answers 431 automatically. Go allows 1 MB (http.DefaultMaxHeaderBytes) and also answers 431.

nginx is a notable exception: when a header line does not fit one of the buffers set by large_client_header_buffers (4 buffers of 8 KB by default), it answers 400 "Request Header Or Cookie Too Large" rather than 431. The same cookie can therefore produce a 400 on one server and a 431 on another.

In local development the typical trigger is localhost: every app you ever ran on localhost:3000 left its cookies there, and they all come back on each request.

If you are visiting the site

• Cookies for the site piled up over time, from analytics, A/B tests, chat widgets and old sessions.
• An extension that injects extra headers into every request.

If you run the server

• Storing session data or a large JWT in a cookie instead of a short session ID.
• Cookies set on the parent domain (.example.com) that every subdomain receives, even ones that never read them.
• A proxy chain that keeps appending to X-Forwarded-For or adds tracing headers at every hop.
• Very long Referer or custom headers carrying encoded state.

If you are visiting the site

• Delete cookies for that site only: in Chrome, click the icon left of the address, then Cookies and site data, and remove them. Then reload.
• Try a private window; if the site works there, cookies were the problem.

If you run the server

• Keep cookies small: store a session ID and look the rest up server-side; scope cookies to the exact host and path that needs them.
• On localhost, clear cookies for localhost or run each project on its own hostname or port.
• If you really need larger headers, raise the limit: node --max-http-header-size=32768, http.Server{MaxHeaderBytes} in Go, large_client_header_buffers 4 32k in nginx. Every proxy in the chain needs the same headroom.

You rarely send 431 from a handler. The HTTP server rejects the request before your code runs, so the useful knobs are the header size limits shown here.

# Reproduce: a 20 KB cookie is over Node.js's 16 KB default
curl -i http://localhost:3000/ -H "Cookie: big=$(head -c 20000 /dev/zero | tr '\0' a)"
# HTTP/1.1 431 Request Header Fields Too Large

# Raise the limit (bytes) only if you really need bigger headers
node --max-http-header-size=32768 server.js

srv := &http.Server{
	Addr:           ":8080",
	Handler:        mux,
	MaxHeaderBytes: 64 << 10, // 64 KB; above this Go answers 431 on its own
}
log.Fatal(srv.ListenAndServe())

# nginx answers 400 "Request Header Or Cookie Too Large", not 431,
# when one header line does not fit a buffer. Default: 4 8k.
large_client_header_buffers 4 32k;

431 vs 413

413 is about the request body (an upload too big); 431 is about the headers, which cookies inflate.

431 vs 414

414 means the URL in the request line is too long; 431 means the header fields after it are too large.

431 vs 400

nginx reports oversized headers as 400 "Request Header Or Cookie Too Large"; Node.js and Go report the same condition as 431.

How do I fix 431 Request Header Fields Too Large in Chrome?

Clear the cookies for that one site (site settings, Cookies and site data) and reload. If you get it on localhost during development, delete the localhost cookies, which pile up from every project you have run there.

What is the header size limit in Node.js?

16 KB for all request headers combined by default. You can raise it with the --max-http-header-size flag or the maxHeaderSize option of http.createServer, but trimming cookies is the better fix.

Why does nginx show 400 instead of 431?

nginx predates RFC 6585 handling for this case and answers 400 "Request Header Or Cookie Too Large" when a header does not fit its large_client_header_buffers. It is the same problem with a different code.