Turkey (Turkish)
Germany (German)
Worldwide (English)
Request flowClient, NGINX, and backend connection break point
Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
This 400 error occurs when the request line or a single HTTP header field exceeds the NGINX buffer capacity. In most cases, it's due to an oversized session cookie, JWT, SSO data, or a header chain added by a reverse proxy.
2026/07/17 04:02:19 [info] 2381#2381: *1223 client sent too large header while reading client request headers
400 Bad Request
Request Header Or Cookie Too LargeNGINX, reads request headers first into the normal buffer, and if large, into the large_client_header_buffers area. If a single header or request line buffer size is exceeded, it returns 400 or in some cases 414.
Clearing browser cookies may temporarily resolve the issue, but the problem is usually that the application produces an excessive number or large cookies on the same domain. Increasing the buffer may reduce symptoms, but the cookie design needs to be fixed.
Adding excessive user permissions, profile, and session data to the JWT increases the Authorization header. This can lead to multiple tokens being added to a single request in SSO and OAuth systems.
In reverse proxy chains, X-Forwarded-For, Cookie, and custom trace headers can grow across layers. If the error occurs only via CDN/load balancer, origin and direct access should be compared.
Buffer values can be allocated as needed for each connection; unnecessary large values increase memory consumption at high concurrency.
Before increasing the buffer, measure which is the largest header, Cookie or Authorization or request URI, and determine what data can be reduced on the application side.
Search for the phrase you see in the email, browser, or SSH log. Each card includes meaning, probable cause, and safe initial action.
Meaning: A header field exceeded the effective large buffer limit.
Possible cause: Large Cookie, Authorization/JWT, or proxy header
Meaning: NGINX cannot accept the client header.
Possible cause: Examine cookie accumulation or insufficient large_client_header_buffers.
Meaning: General 400 message; log root cause is shown.
Possible cause: Header, request line, TLS or broken HTTP request.
Meaning: Request line/URI buffer exceeded the limit.
Possible cause: Long query string, filter or incorrect redirect.
Meaning: Client is not the backend response header crossed the proxy buffer.
Possible cause: Large Set-Cookie or application headers
Meaning: Some middle layers may return 431 for large headers.
Possible cause: CDN, gateway, or application server limit.
Meaning: The application or proxy cookie size was rejected.
Possible cause: Session data being excessively written into the cookie.
Meaning: JWT or authentication header exceeded the limit.
Possible cause: Large claim set or chained token.
No records matching this expression were found.
Commands are for root access. Collect only status and logs first; Do not change the permanent setting without seeing the reason.
curl -skD - https://example.com/ -o /dev/null | grep -i '^set-cookie:'
curl -sk -H 'Cookie: TEST=1' -o /dev/null -w '%{http_code}\n' https://example.com/Examines the production of Set-Cookie and controlled cookie requests.
nginx -T | grep -nE 'client_header_buffer_size|large_client_header_buffers|proxy_buffer_size'Displays client and upstream header buffer values.
grep -R 'too large header\|too long URI' /var/log/nginx 2>/dev/null | tail -n 100Finds the error type and affected request.
curl -sk -D /tmp/basliklar.txt https://example.com/ -o /dev/null
wc -c /tmp/basliklar.txtRoughly measures the total response header size.
curl -skI https://example.com/
curl -skI --resolve example.com:443:ORIGIN_IP https://example.com/Separates whether the CDN/proxy layer increases the header size
nginx -t && systemctl reload nginxMakes a reasonable buffer change safely.
Although the root cause of the NGINX error is the same, package paths, service names, security layers and virtual host management vary depending on the Linux distribution or Plesk infrastructure used.
systemd, package path and journald controls for NGINX 400 Header or Cookie Too Large.
nginx -T | grep -nE 'client_header_buffer_size|large_client_header_buffers'
grep -R 'too large header' /var/log/nginx | tail -n 50SELinux, PHP-FPM pool and RHEL-based service controls for NGINX 400 Header or Cookie Too Large.
nginx -T | grep -nE 'client_header_buffer_size|large_client_header_buffers'
grep -R 'too large header' /var/log/nginx | tail -n 50Plesk-generated NGINX virtual host files in nginx 400 header or cookie too large control.
grep -R 'large_client_header_buffers' /var/www/vhosts/system/example.com/conf /etc/nginx 2>/dev/null
tail -n 100 /var/www/vhosts/system/example.com/logs/proxy_error_logFirst, find out which header has grown; reduce the application data and increase the buffer only if necessary.
Compare with hidden window or cookiesless curl request.
curl -sk -c /dev/null -b /dev/null -o /dev/null -w '%{http_code}\n' https://example.com/Make a distinction between client header, long URI, or upstream response header.
tail -n 100 /var/log/nginx/error.logIdentify and remove unnecessary data from application by largest cookie/JWT area.
curl -skD - https://example.com/ -o /dev/null | grep -i '^set-cookie:'Check the client header setting within the same server scope.
nginx -T | grep -nE 'client_header_buffer_size|large_client_header_buffers'Choose measured sizes for the relevant vhost instead of excessive values across the server.
nginx -tTest access to the same page for new and old cookie users.
nginx -t && systemctl reload nginxSession or JWT cookie may be too large at login.
curl -skD - https://example.com/giris -o /dev/null | grep -i set-cookieExamine session cookies and extension data.
grep 'too large header' /var/log/nginx/error.log | tailMultiple token, state and claim cookies can accumulate on the same domain.
Browser Application > Cookies, compare sizes.Forwarded and trace header chain may be growing.
curl --resolve example.com:443:ORIGIN_IP -skI https://example.com/The query string may need to be converted to POST or a short state token.
python3 - <<'PY'
url='https://example.com/uzun-url'
print(len(url))
PYThis is a client buffer issue, not proxy_buffer_size, and a Set-Cookie problem.
grep 'upstream sent too big header' /var/log/nginx/error.log | tailOccurs when a Cookie, Authorization/JWT, long URI, or another header field exceeds the NGINX buffer size.
No. It temporarily provides access; if the application re-produces the same large cookie, the error will recur.
Large request line and header fields to read, defines buffer size in number and bytes; one field must fit within one buffer size.
Yes. Especially in high concurrency, unnecessary large values can increase memory usage.
No. The error is the backend's response header exceeding the proxy buffer; it is separate from the client's request header settings.
If too much claim or profile data is added to the token, the Authorization or cookie header will grow rapidly.
The Additional nginx directives field in Domain > Apache & nginx Settings can be used; the effective config must be validated after changes.
By analyzing cPanel, WHM, CloudLinux, LiteSpeed, MariaDB, Exim and security layers together, we fix the root cause of the failure instead of just removing the service.