431 Request Header Fields Too Large
The server refuses to process the request because its HTTP header fields, individually or combined, are too large.
Defined in RFC 6585 §5
What 431 means
RFC 6585 defines 431 for when the total size of a request's header fields exceeds the limits a server is willing to process, whether the problem is one oversized header or the combined size of all headers together. The response body may indicate which case applies, though many servers simply refuse the connection before a normal body can even be returned.
In practice the most common cause is cookie bloat: cookies accumulated over months across many subdomains, or a large session token or JWT stored in a cookie, can push the total header size past common server defaults, often around 8 KB. Reverse proxies and load balancers that append their own custom or trace headers on every hop compound the problem further. nginx (large_client_header_buffers), Apache (LimitRequestFieldSize), and Node.js (--max-http-header-size) all expose configurable limits that trigger this response.
JWT-based authentication is a frequent culprit specifically: storing a large token with many claims in a cookie or Authorization header, especially alongside many other cookies set by the same domain, can quietly grow past a server's default header-size ceiling even though no single request looks unusual to the developer who wrote it.
Common causes
- Accumulated cookies, session, tracking, and CDN cookies together, grow past the server's configured header-size limit.
- A large JWT or bearer token stored in a cookie or Authorization header exceeds the size limit on its own.
- A misconfigured redirect loop keeps appending Set-Cookie or custom headers on every hop.
- Proxies or load balancers add many X-Forwarded-* or custom trace headers that sum past the limit by the time they reach the origin.
- A client library sends an unusually large number of custom headers or one oversized header value.
- The server's configured header buffer size, such as nginx's large_client_header_buffers or Node's max-http-header-size, is lower than what a legitimate client actually sends.
How to fix a 431
If you are the client (browser user or API caller)
- Clear cookies for the affected domain, especially stale or duplicate session cookies accumulated over time.
- Reduce the size or number of custom headers sent, and avoid stuffing large payloads into header values.
- Use a shorter, opaque session identifier instead of a large JWT wherever the architecture allows it.
- Check for and break any redirect loop that keeps appending headers on each successive request.
If you run the server
- Increase header buffer limits, such as nginx's large_client_header_buffers, Apache's LimitRequestFieldSize, or Node's --max-http-header-size, if legitimate traffic genuinely needs it.
- Set a narrower cookie scope, using Path and Domain, so cookies are not sent on every request across the entire site.
- Move large tokens out of headers and cookies into a server-side session store referenced by a small opaque ID.
- Audit and trim the headers added by intermediate proxies or load balancers at each hop.
Example
GET /dashboard HTTP/1.1
Host: app.example.com
Cookie: session=eyJhbGciOiJI...(several KB of accumulated cookies)...
HTTP/1.1 431 Request Header Fields Too Large
Content-Type: text/plain
Request header fields exceed the 8KB limit for this server.Try it live
Our free status responder returns a real HTTP 431 you can point tests, monitors or a browser at.
GET https://mcp.httpstatus.com/status/431