Today I'll write about something I experienced personally, on my websites.
Some visitors reported that they were getting a "400 Bad Request" Nginx error randomly when visiting pages. And when they start getting that error, they can't access the site anymore: it'll output the same error no matter the page, until you "clear your cache and cookies".
The error is easily understandable and is likely to be caused by... too much cookie data.
Every time a visitor loads *any* page/content/file of your website, it sends the cookie data to the server.
Cookie data is sent under the form of 1 header line starting with "Cookie: ".
Basically, Nginx by default is configured to accept header lines of a maximum size of 4 kilobytes.
When a line in the headers exceeds 4 kilobytes, Nginx returns the '400 Bad Request' error.
Cookie data sometimes gets big, so it causes the error. It particularly happens on forums like vBulletin, Invision and others.
So why does it happen only for some web browsers (Firefox, Chrome...) and not others? Because those browsers do not limit the amount of data a cookie may store. Or maybe they do, but the limit is higher than the default 4k of Nginx. Other browsers limit the amount of cookie data so they do not have the issue.
There is a simple fix for that. The large_client_header_buffers directive of Nginx allows you to define size of buffers that will contain large headers like those big fat cookies.
The directive specifies: the amount of buffers, and the size of buffers. You basically need to increase the size.
In your http block (or your server block, if you want to apply the setting at the virtual host level), insert this directive with a size larger than 4k (actually the default size can be 8k depending on your system, so let's make it... 16k):
Save your configuration, reload nginx by running /usr/local/nginx/sbin/nginx -s reload and it should now be fine. If you ever get the "400 Bad Request" again, you could either increase this value once more or look into the code and see why cookies get so big.
Some visitors reported that they were getting a "400 Bad Request" Nginx error randomly when visiting pages. And when they start getting that error, they can't access the site anymore: it'll output the same error no matter the page, until you "clear your cache and cookies".
The error is easily understandable and is likely to be caused by... too much cookie data.
Every time a visitor loads *any* page/content/file of your website, it sends the cookie data to the server.
Cookie data is sent under the form of 1 header line starting with "Cookie: ".
Basically, Nginx by default is configured to accept header lines of a maximum size of 4 kilobytes.
When a line in the headers exceeds 4 kilobytes, Nginx returns the '400 Bad Request' error.
Cookie data sometimes gets big, so it causes the error. It particularly happens on forums like vBulletin, Invision and others.
So why does it happen only for some web browsers (Firefox, Chrome...) and not others? Because those browsers do not limit the amount of data a cookie may store. Or maybe they do, but the limit is higher than the default 4k of Nginx. Other browsers limit the amount of cookie data so they do not have the issue.
There is a simple fix for that. The large_client_header_buffers directive of Nginx allows you to define size of buffers that will contain large headers like those big fat cookies.
The directive specifies: the amount of buffers, and the size of buffers. You basically need to increase the size.
In your http block (or your server block, if you want to apply the setting at the virtual host level), insert this directive with a size larger than 4k (actually the default size can be 8k depending on your system, so let's make it... 16k):
http {
[...]
large_client_header_buffers 4 16k;
[...]
}
Save your configuration, reload nginx by running /usr/local/nginx/sbin/nginx -s reload and it should now be fine. If you ever get the "400 Bad Request" again, you could either increase this value once more or look into the code and see why cookies get so big.