HTTP 431 Request Header Fields Too Large

HTTP 431 is Request Header Fields Too Large: the server won’t process the request because its header fields are too large, either all together or a single one (RFC 6585 section 5). The client may try again with smaller headers. When one field is at fault, the response should say which, and caches must not store a 431.

The usual culprits

• Cookies. Every cookie that matches the host and path rides along on every request, and analytics, A/B tests and session data pile up. A cookie set with Domain=example.com goes to every subdomain too.
• localhost. Cookies don’t isolate by port, so every app you’ve run on localhost adds to the same pile. That’s why a Node dev server, such as Vite’s, suddenly answers 431.
• Big tokens. A JWT in Authorization that carries every group the user belongs to.
• Long URLs on servers that count the request line toward the header limit, as Node and Go do.

Who sends it, and who sends 400

Node.js        16 KB for the request line and headers together     431
Go             Server.MaxHeaderBytes, 1 MB by default               431
nginx          large_client_header_buffers 4 8k: a field over 8 KB  400 "Request Header Or Cookie Too Large"
Apache httpd   LimitRequestFieldSize 8190 bytes per field           400

nginx and Apache predate the code and still answer 400, so a “header too large” problem can show up under either number.

Fixes

• As a user, clear the site’s cookies, or localhost’s in development.
• As a developer, keep session state on the server and send a short session ID; give cookies the narrowest Path and host you can instead of a parent Domain; delete cookies you no longer read; keep claims out of JWTs that don’t need them.
• Raise the limit only for legitimately large headers, and in every layer: raising Node’s limit doesn’t help when nginx in front of it rejects the request first.

node --max-http-header-size=32768 server.js

http.createServer({ maxHeaderSize: 32 * 1024 }, app).listen(3000);    // the same, per server

large_client_header_buffers 4 32k;

srv := &http.Server{Addr: ":8080", Handler: mux, MaxHeaderBytes: 64 << 10}

431, 413 or 414

the headers are too big     431 Request Header Fields Too Large
the body is too big         413 Content Too Large
the URL is too long         414 URI Too Long

Some servers close the connection right after a 431, sometimes while the client is still sending, so the client may see a reset instead of the response.

Search 413 414 431 in the tool below to compare the three.