HTTP 421 Misdirected Request – Free, Online, Private

What HTTP 421 means

421 says the server is not able to produce a response for the combination of scheme and authority this request used. It shows up with HTTP/2 and connection reuse: a connection that was allowed for one host received a request for another, and this server will not answer it. The client should retry on a connection that is authoritative for the host. It is not a hint that the URL is wrong.

421 Misdirected Request belongs to the 4xx client error class. Clients that only look at the class will group it with its neighbors. Clients that care about the exact code should use the narrower rule on this page, because the class is only the first digit.

When you see HTTP 421

When you see HTTP 421 Misdirected Request, stop on that exact status line. 421 Misdirected Request means the request arrived at a server that cannot produce this authority. The trace that usually produces it: HTTP/2 connection coalescing sent a request to an origin that does not serve that name. The 4xx client error class only tells you the first digit. A neighbor in that class is a different fault, and the fix on this page does not transfer to it.

Return 421 when this connection is the wrong place for this authority, typically because coalescing or reuse pointed at a server that does not have the certificate or the virtual host. Do not use 421 for an application-level routing mistake you can answer yourself. If you can serve the host, serve it.

How to fix HTTP 421

To fix HTTP 421, change the condition that made the server choose Misdirected Request. Retry on a different connection. Do not reuse the connection that returned 421 for that authority. One retry is normally enough. Yes, on a fresh connection. No, on the same connection. If the log line is a different code, leave this page. The mix-up people make with 421 is this one: 404 means the resource is not on a server that was willing to look. 421 means this server should not have been asked. 400 means the request was malformed.

• A client retried 421 on the same connection and the server refused again.
• A TLS certificate did not cover the host the client put in :authority.
• A gateway used 421 for a downstream 404 and hid the real error.

An access log that only stores 421 is not enough to tell these apart. Keep the method, the path, and a request id. Do not keep the Authorization header or a request body that might be a token. The status explains the outcome. It is not a place to echo secrets back to the client either.

Example response

HTTP 421 Misdirected RequestHTTP/1.1 421 Misdirected Request

The client opens a new connection to the authority it actually wanted and sends the request again. Retrying on the same connection is the bug. The request itself may be perfectly valid. Nothing in the body has to explain the TLS pool, but a short sentence helps a human reading a log.

What the client should do

Retry on a different connection. Do not reuse the connection that returned 421 for that authority. One retry is normally enough.

Do not cache 421 as the state of the resource. The resource was not evaluated.

Yes, on a fresh connection. No, on the same connection.

Codes people confuse with HTTP 421

404 means the resource is not on a server that was willing to look. 421 means this server should not have been asked. 400 means the request was malformed.