Bad Request - Request Too Long HTTP Error 400. The size of the request headers is too long

Question

Some of my users are getting the following error sometimes when they request some of the pages of my site: Bad Request - Request Too Long HTTP Error 400. The size of the request headers is too long

It seems to happen only in Firefox.

Deleting the users cookies does help.

What I don't understand is the following: I thought that cookies are appended to every request. Why is it that only one or two of my pages show this error and most do never?

It is also not dependent on the server page. If the user requests http://example.com/user/Myname he might get the error. If he just changes the capitalization of the URL it works again (like http://example.com/user/myname). (I am running IIS which does not care too much about capitalization).

For the browser the two URLs are different, for the server they aren't.

Any idea what is happening?

Answer 1

It seems that there were too many cookies after all. I made sure that there were not so many and it is working now.

Answer 2

Some of our users also ran into this same exception on IE 8 for some our our intranet sites hosted in IIS. The issue turned out to be related to using Kerberos authentication where a user belongs to many active directory groups.

We found solutions from the following Microsoft Support Articles:

• HTTP 400 - Bad Request (Request Header too long)" error in Internet Information Services (IIS)
• Problems with Kerberos authentication when a user belongs to many groups

The fix for us was to set the following registry keys with increased values and/or create them if they didn't exist:

• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters\MaxFieldLength DWORD (32bit) - assigned value data 32000 (Decimal)
• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters\MaxRequestBytes DWORD (32bit) - assigned value data 8777216 (Decimal)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HTTP\Parameters] "MaxFieldLength"=dword:00007d00 "MaxRequestBytes"=dword:0085ee00