Fix nginx request header or cookie too large

If nginx returns 400 Bad Request with “request header or cookie too large,â€� the fix is to increase the large_client_header_buffers directive in your nginx configuration. By default, nginx limits the size of a single request header line to 8 KB and the total header buffer pool to 32 KB; raising these values resolves the error for most legitimate cases.

What Causes the Error

Nginx allocates a fixed amount of memory to read the HTTP request headers. The large_client_header_buffers directive controls two things: the maximum size of a single header line (like a long cookie or a long URL) and the maximum total size of all headers combined. When a request exceeds these limits, nginx aborts the request and returns a 400 error. Common triggers include:

• Large authentication tokens stored in cookies (e.g., JWT or session IDs).
• Long URLs with many query parameters that exceed the default 8 KB line limit.
• Multiple cookies that together exceed the total buffer size.
• Custom headers added by applications or proxies that are unusually large.

Default Limits and Where They Apply

The default values are large_client_header_buffers 4 8k;, meaning four buffers of 8 KB each. The first buffer is used for the request line (the URL and method), and the remaining buffers are shared for all header lines. If any single header line (including the request line) exceeds 8 KB, nginx returns 400. Also, if the total size of all headers exceeds 32 KB (4 × 8 KB), it returns 400. These limits apply to every request, regardless of the client, so a single oversized cookie can break the entire site for that user.

How to Fix It

To resolve the error, you need to edit your nginx configuration file. The directive can be placed in the http, server, or location context. A common fix is to increase the buffer size to 8 16k; (eight buffers of 16 KB each), which allows a single header line up to 16 KB and a total of 128 KB. Here are the steps:

1. Open your nginx configuration file (usually /etc/nginx/nginx.conf or a file in /etc/nginx/conf.d/).
2. Locate the http block and add or modify the line: large_client_header_buffers 8 16k;
3. Test the configuration with nginx -t.
4. Reload nginx with nginx -s reload (or systemctl reload nginx on systemd systems).

If you are using a reverse proxy setup, ensure the directive is in the server block that handles the client request, not necessarily the upstream. Also, if you use nginx as a load balancer, the same directive applies.

Choosing the Right Buffer Size

There is no one-size-fits-all value. Start by checking the actual size of your cookies and headers. You can do this by inspecting the request in your browser’s developer tools or using a command-line tool like curl -v. If your largest cookie is, say, 12 KB, then a single buffer of 16 KB is sufficient. If you have many cookies, sum their sizes and add some margin for other headers. A typical safe setting for most applications is 8 16k;, but if you have very large tokens, you might need 16 32k; (total 512 KB). However, increasing the buffer size too much can consume memory, especially under high concurrency, because each connection allocates these buffers. As a rule, set the value to the minimum that comfortably accommodates your legitimate requests.

Common Mistakes and Misconceptions

One common mistake is to increase the buffer size but forget to reload nginx, so the change doesn’t take effect. Another is placing the directive in the wrong context—if you put it in a location block that doesn’t match the request, it won’t apply. Some people mistakenly think the error is caused by the client_max_body_size directive, but that controls the request body, not headers. Also, note that increasing the buffer size does not remove the limit; it only raises it. If an attacker sends an extremely large header, it can still cause a 400, but that’s intentional. Finally, be aware that some CDNs or proxies in front of nginx may have their own header size limits; if you still see the error after fixing nginx, check those as well.

Alternatives to Increasing Buffer Size

If you cannot or do not want to increase the buffer size, consider reducing the size of the headers themselves. For cookies, you can:

• Store session data on the server and keep only a small session ID in the cookie.
• Use a shorter token format (e.g., switch from JWT to an opaque token).
• Split large data across multiple cookies, but be aware that each cookie still counts toward the line limit.
• Move data from headers to the request body or URL query parameters (if appropriate).

For URLs, consider using POST requests with data in the body instead of long query strings, or implement pagination to reduce the number of parameters. These approaches reduce the need for large buffers and improve overall performance.

Frequently Asked Questions

What is the default nginx header buffer size?

The default is large_client_header_buffers 4 8k;, which allows a single header line up to 8 KB and a total of 32 KB for all headers.

Will increasing the buffer size affect performance?

Yes, slightly. Each client connection allocates the configured buffers, so larger buffers consume more memory per connection. Under normal load, the impact is negligible, but if you have thousands of concurrent connections, it can add up. Monitor memory usage after making the change.

Can I set the buffer size to a very large value like 1 MB?

Technically yes, but it is not recommended because it wastes memory and may allow denial-of-service attacks that consume server resources. Set it to the smallest value that accommodates your legitimate requests.

Why do I still see the error after increasing the buffer?

Possible reasons: you edited the wrong configuration file, the directive is in the wrong context, you didn’t reload nginx, or there is another proxy (like Cloudflare) with its own header size limit. Also, check if the error message includes a specific header name—it might be a single header that still exceeds the new line limit.

Is this error related to the client_max_body_size directive?

No. client_max_body_size limits the size of the request body (e.g., file uploads), not headers. If you get a 413 Request Entity Too Large, that’s a different issue.

Does this fix apply to nginx plus or open source versions?

Yes, the large_client_header_buffers directive is available in all nginx versions, including open source and commercial. The syntax and behavior are the same.

Related

• Refresh Rate & Input Lag for a Second Esports Monitor
• Energy vs Power Signals: Definitions, Equations & Examples
• Marvel Rivals Leaked Files: Amaranth White Fox Appearance