HTTP 431 Request Header Fields Too Large – Free, Online, Private

What HTTP 431 means

431 says the server refuses the request because a header field, or all of them together, is too large. Cookies are the usual culprit. The body should say whether one field or the whole set was the problem, if the server is willing to say. The client has to shrink the headers. Retrying the same request will fail. RFC 6585 defines the status.

431 Request Header Fields Too Large belongs to the 4xx client error class. Clients that only look at the class will group it with its neighbors. Clients that care about the exact code should use the narrower rule on this page, because the class is only the first digit.

When you see HTTP 431

When you see HTTP 431 Request Header Fields Too Large, stop on that exact status line. 431 Request Header Fields Too Large means a header or the header block is too big. The trace that usually produces it: A cookie jar grew without a limit and the Cookie header crossed the server's cap. The 4xx client error class only tells you the first digit. A neighbor in that class is a different fault, and the fix on this page does not transfer to it.

Return 431 when you reject oversized headers. Use 413 for an oversized body and 414 for an oversized URI. Do not quietly drop a cookie and proceed. The client would think it was authenticated with credentials you ignored. Failing visibly is better.

How to fix HTTP 431

To fix HTTP 431, change the condition that made the server choose Request Header Fields Too Large. Shrink the headers and retry once. Do not add diagnostic headers to the retry. If a browser cookie is the problem, the user has to delete it. Your script cannot always do that. Only after the headers are smaller. The same headers fail again. If the log line is a different code, leave this page. The mix-up people make with 431 is this one: 413 is the body. 414 is the URI. 400 is a header you could not parse. 431 is a header that parsed as too big.

• A JWT in Authorization became huge and a proxy rejected it.
• The total header block, not one field, crossed the limit.
• A client retried and added another header, making the next attempt larger.

An access log that only stores 431 is not enough to tell these apart. Keep the method, the path, and a request id. Do not keep the Authorization header or a request body that might be a token. The status explains the outcome. It is not a place to echo secrets back to the client either.

Example response

HTTP 431 Request Header Fields Too LargeHTTP/1.1 431 Request Header Fields Too Large
Content-Type: text/plain

Cookie header is too large.

The body names the Cookie header. The client should clear cookies for the site or stop sending the oversized field. A browser user may need to delete site data. An API client should stop attaching unused headers. The server should log the size, not the contents, if the contents might be credentials.

What the client should do

Shrink the headers and retry once. Do not add diagnostic headers to the retry. If a browser cookie is the problem, the user has to delete it. Your script cannot always do that.

Do not cache 431. It is about the request headers.

Only after the headers are smaller. The same headers fail again.

Codes people confuse with HTTP 431

413 is the body. 414 is the URI. 400 is a header you could not parse. 431 is a header that parsed as too big.