400 Bad Request: Request Header or Cookie Too Large? How to Fix It in 2 Minutes

"400 Bad Request: Request Header Or Cookie Too Large" is one of the few browser errors that tells you exactly what is wrong. Your browser has stored so many cookies for one site that the server refuses to read them. The page is fine. Your cookies for that site are just too big to send.

The fix takes two minutes and signs you out of one site only. This guide explains why it happens, how to fix it in Chrome, and what site owners can do so visitors never see it.

The short answer#

• What it means: the site's cookies grew past the server's header limit, often 8 KB.
• Fix it: delete cookies for that site only, then reload.
• Clearing cache will not help. It is a cookie problem.
• Own the site? Fewer, smaller cookies, or a larger header limit.

Why the cookie header gets too large#

Every time your browser asks a site for a page, image or script, it attaches all the cookies it holds for that site in a single Cookie: header. Servers do not accept headers of unlimited size:

The nginx documentation says a header field larger than one buffer gets a 400 Bad Request. The "Request Header Or Cookie Too Large" wording is what many nginx-based servers show with it.

Browsers, meanwhile, are allowed to store a lot. The cookie standard, RFC 6265, asks browsers to support at least 4,096 bytes per cookie and at least 50 cookies per domain. Two or three large cookies, or dozens of small ones, can pass 8 KB. Over time that happens on sites that:

• set a new session cookie at every sign-in without clearing the old one,
• run many A/B tests, each with its own cookie,
• load analytics and marketing tools that all write cookies on the same domain,
• share one parent domain across many subdomains, each adding cookies.

How to fix it in Chrome#

You only need to clear the cookies of the site showing the error.

Method 1: from the address bar

1. On the error page, click the View site information icon left of the address.
2. Click Cookies and site data, then Manage on-device site data.
3. Delete every entry for that site, including subdomains such as www or app.
4. Click Done and reload.

Method 2: from Settings (if the error page shows no icon)

1. Paste chrome://settings/content/all into the address bar.
2. Search the site's main domain, for example example.com.
3. Click it, then Delete data, and confirm.
4. Go back and reload.

You will be signed out of that site, and nowhere else. If you want a one-click version, Cleaner, our free Chrome extension, clears the current site's cookies with Sign out & reset, reloads the page and shows how many cookies it removed. Seeing "Removed 87 cookies" is a good hint that this was the problem.

Our general guide on how to delete cookies in Chrome covers every other method.

Where the error shows up most#

Because the limit lives on the server, the error clusters on certain kinds of sites:

• Big sites with many subdomains, where every subdomain adds cookies on the shared parent domain.
• Shops and media sites that load many analytics, advertising and testing tools, each writing its own cookies.
• Sign-in portals and single sign-on pages, where every login attempt can add another session cookie.
• Sites you have used for years without ever clearing anything.

It is also more common on browsers you never clean than on phones that clear data more often, which is why the same site may work on your phone and fail on your laptop. The phone simply carries fewer cookies for that site.

Still getting the error?#

• Check the parent domain. Cookies for example.com are sent to shop.example.com too. Clear the parent domain as well as the subdomain.
• Close all tabs of the site before reloading. An open tab can write cookies back the moment you clear them.
• Try an Incognito window. If it works there, it was your cookies; clear again more thoroughly. If it fails there too, the server is rejecting something else, and only the site can fix it.
• Turn off extensions that add headers, such as some VPN, privacy or developer tools. They make the request header bigger.

What does not work#

• Clearing the cache. Cached files are not sent to the server. The cookies are.
• Clearing all browsing data. It works, but signs you out of every site to fix one. See clearing cache without losing passwords for the difference.
• Another browser works only until its cookies grow too.

If you run the site#

Visitors should never see this. The fixes, from best to quick:

1. Audit your cookies. Open DevTools on your own site, go to Application, then Cookies, and add up the sizes. Remove cookies you do not need, and scope them to the subdomain or path that actually uses them.
2. Keep sessions small. Store a short session ID in the cookie and the data on the server, not the other way round.
3. Expire old experiments. A/B test cookies should have short lifetimes.
4. Raise the limit if you must. In nginx, increase large_client_header_buffers, for example to 4 16k. In Apache, raise LimitRequestFieldSize. Proxies and load balancers in front of your server may have their own limits too.
5. Rescue stuck visitors. A response with the Clear-Site-Data: "cookies" header on a small, static recovery page clears your site's cookies for anyone who opens it.

Bottom line#

This error is a cookie pile-up on one site. Clear that site's cookies, reload, and you are done. If it keeps coming back, the site is adding cookies faster than it removes them, and that is worth a short message to their support team.