Docs

Request Header or Cookie Too Large

Overview

A “400 Request Header Or Cookie Too Large” error means the WAF edge rejected the request before it reached your application, because the combined size of its HTTP headers (usually cookies) exceeded the allowed limit.

This limit is a security measure: oversized headers are a known technique for disrupting servers, so the edge enforces a maximum size on every request.

Why It Happens

The most common cause is cookie accumulation. Browsers send every cookie scoped to a domain with every request, and these add up:

  • Analytics and A/B testing tools that set many cookies
  • Session or preference data stored directly in cookies
  • Cookies set at the parent-domain level (.example.com), which are sent to every subdomain
  • Large authentication tokens (JWTs) stored in cookies or headers

A single visitor hits the error when their accumulated cookies for your domain cross the size limit, which is why it often affects only some users, and often your longest-tenured ones.

Fix for an Affected Visitor

Clearing cookies resolves it immediately:

  1. Clear cookies and cached data for the affected site (not necessarily all sites).
  2. Reload the page.

Testing in a private/incognito window is a quick way to confirm cookies are the cause: if the page loads there, the regular session’s cookies are over the limit.

Fix for Site Owners

If your users are hitting this error, the fix is reducing what your site (and its third-party scripts) stores in cookies:

  1. Open your site in a browser, then open developer tools and inspect cookies (in Chrome: Application, then Cookies).
  2. Sort by size and identify the large ones.
  3. Move large values server-side and keep only an identifier in the cookie, trim JWT claims, or scope cookies to the specific subdomain that needs them instead of the parent domain.

Reporting It to Support

This error type is not shown in your WAF dashboard logs, so if you want us to investigate a specific occurrence, include:

  • The visitor’s public IP address
  • The exact time of the error (with timezone)
  • Browser and device
  • The page URL being accessed

Need Help?

If the error persists after clearing cookies, or you would like us to investigate: