431 communication resource_error ai_generated true

HTTP/1.1 431 Request Header Fields Too Large

ID: communication/http-431-request-header-fields-too-large

Also available as: JSON · Markdown · 中文
90%Fix Rate
90%Confidence
1Evidence
2024-06-30First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
nginx 1.26.0 active — — —
Apache HTTP Server 2.4.59 active — — —
Node.js 22.0.0 active — — —

Root Cause

The total size of HTTP request headers exceeds the server's configured limit (typically 8 KB to 16 KB).

generic

中文

HTTP请求头的总大小超过了服务器的配置限制（通常为8 KB到16 KB）。

Official Documentation

https://httpwg.org/specs/rfc6585.html#status-431

Workarounds

  1. 95% success Increase the server's request header buffer size. For Nginx: 'large_client_header_buffers 4 32k;' in http or server block. For Apache: 'LimitRequestFieldSize 16380' in httpd.conf. 
    Increase the server's request header buffer size. For Nginx: 'large_client_header_buffers 4 32k;' in http or server block. For Apache: 'LimitRequestFieldSize 16380' in httpd.conf.
  2. 85% success Reduce cookie sizes or move large state to server-side sessions. Example in Express.js: app.use(session({ store: new RedisStore(), cookie: { maxAge: 60000 } })) — store session data server-side instead of in cookies. 
    Reduce cookie sizes or move large state to server-side sessions. Example in Express.js: app.use(session({ store: new RedisStore(), cookie: { maxAge: 60000 } })) — store session data server-side instead of in cookies.

中文步骤

  1. Increase the server's request header buffer size. For Nginx: 'large_client_header_buffers 4 32k;' in http or server block. For Apache: 'LimitRequestFieldSize 16380' in httpd.conf.
  2. Reduce cookie sizes or move large state to server-side sessions. Example in Express.js: app.use(session({ store: new RedisStore(), cookie: { maxAge: 60000 } })) — store session data server-side instead of in cookies.

Dead Ends

Common approaches that don't work:

  1. Increase server memory or CPU 90% fail

    The error is a hard limit on header size, not a resource shortage; memory increase does not affect the limit.

  2. Disable all security modules or firewalls 50% fail

    Most security tools do not cause this error; disabling them may expose the server without fixing the header size issue.