431 Request Header Fields Too Large
The request headers are collectively or individually too large for the server to process.
Status
HTTP/1.1 431 Request Header Fields Too Large
Details
- Category: 4xx
- Status: Standard. Registered with IANA and defined by a current standards-track RFC.
- Specification: RFC 6585 §5
- Cacheable: Only with explicit cache headers
- Response body: Allowed
- Retry: Retry only after changing the request
431 covers both cases: the whole header block exceeded the server's buffer, or one field did. Cookies are the usual offender, since they accumulate silently until a single domain sends several kilobytes on every request.
The response should say which field was the problem when it can, because a client with no idea which header is oversized has little to work with.
Common causes
- Accumulated cookies for a domain exceeding the server's header limit.
- A very large Authorization header, such as a JWT stuffed with claims.
- Long Referer or custom tracking headers added by middleware.
- A redirect loop that appends a header on each pass.
How to fix it
As the client
- Clear cookies for the site. This resolves most browser-side 431s immediately.
- Shrink tokens: reference server-side session state instead of embedding large claim sets.
- Remove unnecessary custom headers from automated clients.
As the server
- Raise header buffer limits where large headers are legitimate, for example large_client_header_buffers in nginx.
- Keep cookies small and scoped, and avoid setting them on static asset paths.
- Name the offending header in the response body.
Examples
GET / HTTP/1.1 Host: www.example.com Cookie: (12KB of accumulated cookies) HTTP/1.1 431 Request Header Fields Too Large Content-Type: text/plain Cookie header exceeds 8192 bytes