431
Client Error
431 Request Header Fields Too Large: Oversized Headers
✦ The Golden Answer: The 431 Request Header Fields Too Large status code indicates that the server is refusing to process the request because either the total size of the request headers exceeds the server's limit, or a single header field is too large. This is commonly caused by oversized cookies (e.g., many cookies or very large values), long Authorization headers (e.g., large JWTs), or custom headers with large payloads. The fix is to reduce the header size or increase the server's header buffer limits.
Common Causes of 431 Errors
| Cause | Example | How to Fix |
|---|---|---|
| Oversized cookies | Many cookies or cookies with large values (e.g., session data). | Reduce cookie size, split across multiple cookies, or use server-side sessions. |
| Large Authorization header | JWT token with many claims (e.g., 4KB+). | Shorten the token, use shorter claim names, or use a token format with less overhead. |
| Too many custom headers | Client sends dozens of custom headers (e.g., for debugging or tracing). | Remove unnecessary headers or combine them. |
| Server limit too low | Nginx default header buffer is 8KB, but request headers are 12KB. | Increase the header buffer size in server configuration. |
| Proxy or CDN adds headers | Intermediate systems add their own headers, exceeding limits. | Check proxy/CDN settings to reduce added headers. |
Example: 431 Response
A client sends a request with very large cookies, and the server rejects it:
GET /api/data HTTP/1.1
Host: example.com
Cookie: session=very_long_string... (4 KB)
Authorization: Bearer very_long_jwt... (5 KB)
HTTP/1.1 431 Request Header Fields Too Large
Content-Type: text/html
<html>
<body>
<h1>431 Request Header Fields Too Large</h1>
<p>The request headers are too large. Please reduce their size.</p>
</body>
</html>
How to Fix 431 Errors
- If you're a client developer: Reduce the size of your headers. For cookies, store minimal data and use server-side sessions. For Authorization headers, use shorter tokens or compress the payload. Remove unnecessary custom headers. If you're using a mobile app, consider using a token format like JWT with minimal claims.
- If you're a server administrator: Increase the header buffer limits. In Nginx, use
large_client_header_buffers(e.g.,4 16k). In Apache, useLimitRequestFieldSize(e.g.,16380). In Node.js, adjust themaxHeaderSizeoption (available in newer versions). - If you're an end‑user: This error is rare in browsers but can happen if you have many browser extensions adding headers, or if you're using a VPN/proxy that adds extra headers. Try clearing cookies, using a private browsing window, or disabling extensions.
Server Configuration Examples
Nginx:
large_client_header_buffers 4 16k; # increase from default 8k
Apache (httpd.conf):
LimitRequestFieldSize 16380 # bytes
Node.js (http.createServer):
const server = http.createServer({ maxHeaderSize: 16384 }, app);
431 vs. 413
- 431 – request headers are too large (cookies, auth, custom headers).
- 413 – request body (payload) is too large.
Frequently Asked Questions
Is 431 a client error or a server error?
It's a client error (4xx) because the client's headers are too large. The server is working correctly but has size limits in place.
What is the typical header size limit?
Nginx defaults to 8KB for the total header size. Apache defaults to 8KB. Cloudflare has a 32KB limit. Node.js defaults to 16KB (as of recent versions). The limits vary.
Can I compress headers to avoid 431?
HTTP headers are not compressed by default, but you can use HTTP/2 which compresses headers (HPACK) and reduces their size on the wire. However, the server still sees the uncompressed headers, so the limit is on the decoded size.