Oversized request headers and the 400 that follows

Users get intermittent 400s after logging in; clearing cookies helps briefly.

nginx has two limits: large_client_header_buffers (4 8k by default) and client_header_buffer_size (1k). A request line or single header beyond the buffer yields 400 or 414.

2024/09/09 10:12:03 [error] client sent too long header line

Either raise the buffers or, more usefully, reduce cookies. Every cookie on the domain is sent on every request, and analytics, A/B tests and third-party scripts each add one until the header is kilobytes.

large_client_header_buffers 4 16k;

Do not raise it without limit; headers are an attack surface.