HTTP 431 Request Header Fields Too Large

431 Request Header Fields Too Large (RFC 6585) means the server refused the request because its headers, all together or one of them, are larger than it accepts. In browsers this is almost always cookies: too many, or too large, for that host. Clear the site's cookies and retry; if large headers are legitimate, raise the server's header size limit.

Reproduce it

A Node.js server with the default limit (16 KiB) and a request with a 20 KB cookie, then the same server with --max-http-header-size=32768:

cat > server.js <<'EOF'
require("http").createServer((req, res) => res.end("ok\n")).listen(4923, "127.0.0.1");
setTimeout(() => process.exit(0), 4000);
EOF
BIG=$(head -c 20000 /dev/zero | tr '\0' x)
node server.js &
sleep 1
echo "small request: $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:4923/)"
curl -s -i -H "Cookie: session=$BIG" http://127.0.0.1:4923/ | tr -d '\r'
wait
node --max-http-header-size=32768 server.js &
sleep 1
echo "with a 32 KiB limit: $(curl -s -o /dev/null -w '%{http_code}' -H "Cookie: session=$BIG" http://127.0.0.1:4923/)"
wait

small request: 200
HTTP/1.1 431 Request Header Fields Too Large
Connection: close

with a 32 KiB limit: 200

Node.js answers 431 itself, before your request handler runs, so your code never sees the request and nothing appears in your application logs.

Where the limit is set

All servers on the path must accept the size: raising the limit in Node.js does not help if a reverse proxy in front of it rejects the request first.

In the browser

Open the developer tools, Application (Chrome) or Storage (Firefox), and delete the cookies for the host. On localhost in development, cookies from every app you ever ran on that host are sent together, which is a common way to exceed the limit.