431 Request Header Fields Too Large
The request headers are collectively or individually too large. Oversized cookies are the usual cause.
At a glance
- Status code
- 431 Request Header Fields Too Large
- Class
- 4xx, client error, the request itself is the problem
- Defined in
- RFC 6585
- Cacheable by default
- no
- Response body
- Should name the offending header if possible.
In detail
Servers cap total header size, typically around 8KB, and a single header too. Exceeding either produces 431.
Name the header that broke the limit if you can. A generic 431 sends people hunting through every header they send.
Check cookie size first. A cookie set on a parent domain accumulates across subdomains and is sent on every request, including for static assets.
Examples
HTTP/1.1 431 Request Header Fields Too Large
Content-Length: 0Things that catch people out
- Once the cookie is too large the client cannot load the page that would clear it, so users get stuck until they delete cookies manually.
- Some servers close the connection rather than answering 431, so the client sees a reset rather than a status code.
Try it: HTTP Request Builder
Build a request with any method, headers and body, send it, and read the status line the server returns.
HTTP Request Builder
LOCAL · Browser-OnlyBuild and test HTTP requests with custom headers and body
Authentication
Headers
Generate Code
curl -X GET 'https://api.example.com/endpoint' \
-H 'Content-Type: application/json'Showing a sample URL. Enter your endpoint above to update the snippet.
Related HTTP status codes
All http status codes →413 Content Too Large
The request body is larger than the server is willing to process. Formerly called Payload Too Large.
414 URI Too Long
The request URL is longer than the server will accept. Almost always caused by putting data in a query string that belongs in a request body.
400 Bad Request
The server refused the request because it was malformed. The client must change something before retrying, because repeating the same bytes will fail.
451 Unavailable For Legal Reasons
Access is denied because of a legal demand, such as a court order or a government blocking request.
500 Internal Server Error
The server hit an unexpected condition and cannot say anything more specific. It is the catch-all for unhandled exceptions.
501 Not Implemented
The server does not support the functionality required to fulfil the request, typically an unrecognised request method.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL