400 Bad Request error: what causes it and how to fix it

02Causes of a 400, sorted by the layer that rejects them

Start by asking which layer refused the request, because each one checks different things.

03What the 400 page says on each server

The wording of the page is the quickest clue. The nginx texts below are its built-in pages, reproduced on nginx 1.22.1; the Node.js response was reproduced on Node.js 22, the Cloudflare page was observed, and the others are quoted from each project's source code or documentation.

04The curl test that shows which layer rejected the request

Two comparisons answer most questions. First, send the request through the public hostname and straight to the origin with the same hostname and TLS server name: if only the first returns 400, the edge or a proxy rejected it, and the Server header says which. Second, if your browser gets a 400 and curl does not, the difference lies in what the browser sends.

For the second case, open the browser's developer tools, find the failing request in the Network panel, right-click it and choose Copy, then Copy as cURL. Paste the command into a terminal, confirm that it still fails, and delete headers one at a time, starting with Cookie, until it succeeds. The last header you removed is the cause.

# through the CDN or proxy
curl -s -o /dev/null -D - 'https://example.com/failing/path' | grep -iE '^(HTTP|server|via|cf-ray|x-cache)'

# straight to the origin, same Host header and SNI
curl -s -o /dev/null -D - --resolve example.com:443:203.0.113.10 'https://example.com/failing/path' | grep -iE '^(HTTP|server)'

# how many bytes the request itself was
curl -s -o /dev/null -w '%{http_code} %{size_request} bytes\n' 'https://example.com/failing/path'

05Why nginx logs nothing for a 400, and how to see the reason

nginx writes the cause of a client-side 400 at the info level, and the error_log default level is error, so on a stock configuration the access log shows the 400 and the error log stays silent. Raise the level for a short while, reproduce the failure, then set it back, because info is verbose on a busy server.

Every line below was produced on nginx 1.22.1 by sending the matching broken request; long values are shortened.

# /etc/nginx/nginx.conf, main context
error_log /var/log/nginx/error.log info;

nginx -t && systemctl reload nginx
tail -f /var/log/nginx/error.log | grep 'client sent'

06How to fix a 400 Bad Request as a visitor

• Check the address for stray characters: a % that is not followed by two hex digits, spaces, or a URL pasted twice
• Delete the cookies for that one site and reload; this fixes the cookie-size and corrupt-cookie cases
• Try a private window: if it works there, stored site data or an extension is the cause
• Disable browser extensions that rewrite pages or add headers, then retry
• If an upload fails, try a smaller file; some applications answer an oversized upload with 400 rather than 413

07How to fix a 400 as a site owner

Treat the 400 as a symptom and fix the component that produced the bad request. Raising limits or disabling checks only moves the problem.

• Oversized cookies: find the cookie that grew before raising nginx's large_client_header_buffers or Apache's LimitRequestFieldSize
• Plain HTTP to the HTTPS port: make the upstream scheme match, for example proxy_pass https:// for a TLS backend, or point the proxy at the HTTP port; the reverse mistake, plain HTTP answering on port 443, shows up in Chrome as ERR_SSL_PROTOCOL_ERROR
• Missing or wrong Host from a proxy or custom client: send the hostname the backend expects, for example proxy_set_header Host $host in nginx
• Ambiguous Content-Length and Transfer-Encoding: fix the client or library that sends both; do not relax the check, which protects against request smuggling
• API validation errors: return a body that names the field and the problem, for example in the Problem Details format of RFC 9457, so callers can fix their request
• A sudden spike in 400s from many addresses often means scanning or a flood of junk requests rather than a bug; a WAF absorbs that traffic before it reaches the origin