Chrome 'net::ERR_HTTP2_PROTOCOL_ERROR' (sometimes 200 OK but failed to load) behind Nginx, a CDN or a load balancer. What causes it and how do I fix it?

Cause: the browser's HTTP/2 connection to the front end was reset or violated the protocol. The error message is generic, so find which layer broke it. Common causes: - Request or response headers too large (huge cookies, long URLs, big Set-Cookie or Link headers) for a proxy limit. Nginx limits each request header field and the whole decompressed header list with large_client_header_buffers (default 4 buffers of 8k; the limit also applies to HTTP/2), returning 400 or 414 when exceeded. - A connection closed by an idle or max-lifetime timeout, or after a maximum number of requests on the connection, while the browser tries to reuse it. Nginx closes a connection after keepalive_requests requests or keepalive_timeout idle time. ALB closes idle connections after 60 seconds by default and ends long-lived client connections with a GOAWAY frame after its HTTP client keepalive duration (default 3600 seconds). - An origin or proxy that sends a malformed response (wrong Content-Length, truncated body, invalid headers) or a mismatch between layers. - Security devices or antivirus software that interfere with HTTP/2. Fix: 1. Reproduce with DevTools Network log and chrome://net-export, and curl --http2 -v URL (and --http1.1) to see whether HTTP/1.1 works. If it does, the problem is HTTP/2 specific. 2. Reduce header size: clear or shrink cookies, remove unneeded headers. If needed raise large_client_header_buffers (for example 4 16k) at the server level, but fix oversize cookies first. 3. Align timeouts: make the app and upstream keepalive time longer than the load balancer's idle timeout so the balancer never reuses a connection the backend already closed. 4. Check proxy and origin logs for upstream resets, truncated responses or premature closes on the failing URL; fix mismatched Content-Length or compression settings. 5. Update nginx, the CDN configuration and application server to supported versions. 6. As a temporary diagnostic only, disabling HTTP/2 on the listener shows whether it is the cause; do not leave a broken backend in place. Verify: the failing request returns a complete response over h2 (DevTools Protocol column shows h2) repeatedly, including after the connection has been idle past the proxy and load balancer timeouts. Sources: https://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers https://nginx.org/en/docs/http/ngx_http_v2_module.html https://docs.aws.amazon.com/elasticloadbalancing/latest/application/edit-load-balancer-attributes.html