421 Misdirected Request
The request reached a server that is not configured to produce a response for the requested authority.
Status
HTTP/1.1 421 Misdirected Request
Details
- Category: 4xx
- Status: Standard. Registered with IANA and defined by a current standards-track RFC.
- Specification: RFC 9110 §15.5.20
- Cacheable: Not cacheable
- Response body: Allowed
- Retry: Safe to retry
421 belongs mostly to HTTP/2 connection coalescing. A client that already holds a connection to one host may reuse it for another host covered by the same certificate. If the server behind that connection cannot serve the second host, it answers 421 and the client must open a fresh connection.
It also appears on plain HTTP/1.1 when a request arrives with a Host header that no virtual host matches and the server refuses to fall back to a default.
Common causes
- HTTP/2 connection reuse across hosts that share a certificate but not a backend.
- A Host or :authority header that does not match any configured virtual host.
- A TLS SNI value that disagrees with the Host header, which strict servers reject.
How to fix it
As the client
- Retry on a new connection. The specification explicitly allows this, and most clients do it automatically.
- Disable connection coalescing for the affected hosts if retries keep failing.
- Make sure SNI and the Host header agree when connecting through tooling that lets you set them separately.
As the server
- Keep certificates scoped to the hosts a given backend can actually serve.
- Configure a default virtual host that returns a clear error rather than a confusing one.
Examples
GET /assets/logo.png HTTP/2 :authority: cdn.example.com HTTP/2 421 content-type: text/plain Connection is not authoritative for cdn.example.com