HTTP 431 'Request Header Fields Too Large' (or nginx 400 'Request Header Or Cookie Too Large') caused by oversized cookies: how do I fix it?

Cause: the server refuses a request because its headers are too big, either in total or because one header is. The usual culprit is the Cookie header, when an app or several apps on the same domain keep adding cookies (session blobs, tracking, stale cookies from old deployments). A very long URL can also bloat the Referer header. HTTP defines 431 for this; some servers answer with a different 4xx. nginx, for example, documents 400 when one header field exceeds a buffer and 414 for an overlong request line. Fix (best first): 1. Reduce what the client sends. Delete unnecessary cookies, stop storing large data in cookies (keep a session id in the cookie and the data server-side), scope cookies with Path and Domain so they are not sent to every subdomain, and set expiry on temporary ones. 2. As an immediate workaround for one user, clear cookies for the site. 3. Shorten very long query strings, and use a Referrer-Policy to limit what is sent in Referer. 4. If the headers are legitimate, raise the limit on every hop: in nginx, large_client_header_buffers (default 4 8k; for example large_client_header_buffers 4 16k;) in http or server context; in Tomcat max_http_header_size; and check any load balancer or CDN limit. Raise modestly; big limits increase memory use per connection. 5. Make the server say which header was too large, so clients can react. Verify: the previously failing request now returns normally, the Cookie header size in browser developer tools is well below the limit, and a fresh browser profile logged in the same way also works. Sources: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/431 https://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers