400 Bad Request: What Was Wrong With the Request

HTTP 400 Bad Request tells you the server received something it could not read or would not accept as valid. The fault is in the request itself: an oversized cookie or header, a URL with illegal characters, a JSON body that does not parse, or a missing required field. Fix what was sent, then retry.

Typical 400 causes and where to fix them
What you seeReal causeFix
Request Header Or Cookie Too Large (Nginx)Cookies for the domain exceed the header bufferClear the site's cookies, or raise large_client_header_buffers
400 only in one browserA stale or corrupted cookieDelete cookies for that site only
400 from an API callBody is not valid JSON or a field is missingValidate the payload and send Content-Type: application/json
400 after pasting a linkUnencoded spaces, quotes or % in the URLEncode the value with encodeURIComponent
400 on file uploadMultipart boundary broken by a manual headerLet the browser set Content-Type for FormData

Updated

A 400 is a client error, so the server is up and reachable. That narrows the search a lot. Compare a request that fails with one that works: usually the difference is a cookie, a header, the body or the URL. Server logs often name the exact parse failure.

Server and client fixes

Raise Nginx header buffers

Goes in the http or server block. Test the config before reloading.

# /etc/nginx/nginx.conf
large_client_header_buffers 4 32k;

sudo nginx -t && sudo systemctl reload nginx

Send a JSON body the server can parse

Without JSON.stringify and the header, many servers reply 400.

await fetch("/api/orders", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ sku: "A12", qty: 2 }),
});

Fixing Nginx header and cookie limits

Nginx reads request headers into buffers. When a single header line or the whole header block is bigger than large_client_header_buffers allows, it returns 400 with the cookie too large message. Raising the limit treats the symptom; trimming cookies fixes the cause.

Behind a load balancer, check its own limits too. The proxy in front may reject the request before Nginx sees it, so the error page's branding tells you which layer to change.

Fixing 400s from your own API calls

Log the exact body your client sends and run it through a JSON parser. Trailing commas, single quotes and undefined values are the classic breakages. In frameworks with schema validation, the error response lists the failing path, so print it instead of only the status.

If a page on a site hosted by We.Inc ever shows a 400, clearing that site's cookies is the first thing to try, then tell support if it persists.

How it works

  1. Retry in a private window; if it works there, the cause is a cookie in your normal profile.
  2. Open the browser's Network tab and inspect the failing request's headers, URL and payload.
  3. Read the response body, since many APIs explain which field was rejected.
  4. Fix the request, or raise the server limit if the request is legitimately large.

Tips

  • Analytics and A/B testing scripts can pile dozens of cookies onto one domain. Once the Cookie header passes about 8 KB, Nginx's default buffers reject it.
  • Sending an object straight to fetch without JSON.stringify posts the text [object Object], which most APIs answer with 400.
  • Express needs app.use(express.json()) before your routes, or req.body is undefined and validation fails.
  • For a visitor, deleting cookies for the one site fixes most 400 pages without signing out of everything else.

Frequently asked questions

What does HTTP code 400 mean?

It means Bad Request: the server will not process the request because something in it looks malformed or invalid. Unlike 5xx codes, the server is healthy; what it received is the problem.

How do I fix 400 Bad Request Request Header Or Cookie Too Large?

As a visitor, clear cookies for that domain. As the site owner, cut the number and size of cookies you set, and if needed raise large_client_header_buffers in Nginx, for example to 4 32k, then reload Nginx.

Is 400 Bad Request my fault or the website's?

Usually something stored in your browser or typed into the address is off, so clearing cookies or fixing the link helps. If it fails for everyone, the site's own code is sending bad requests.

What is the difference between 400 and 422?

Many APIs use 400 when the request cannot be parsed at all and 422 Unprocessable Content when it parses but fails validation rules, such as an invalid email. Both mean change the request.

Related: HTTP status codes, 401 vs 403, 405 Method Not Allowed, JavaScript fetch and async.

Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.

More in Guides

Product

Who It's For

Features

Resources

Company

View Sitemap