On attempting to login into either a front-end account or admin account I'm hit by:

400 Bad Request
Request Header Or Cookie Too Large

It's only happened recently but running the latest Craft CMS v2.5.2757 and from looking at the cookies created during login I think it's possibly related to CSRF protection as deleting the top cookie in the list below fixes the issue until you log in again.

Google Console Log

Running a few other Craft sites on the same staging nGinx server without the same issue, and even the same codebase is running another site without issue.

Any thoughts please?!


Add this to your nginx server block:

server {
  large_client_header_buffers 4 16k;

and restart nginx. The default is 8k. If you have a lot of headers, beefing that value up should resolve it otherwise you may want to play with client_header_buffer_size as well.

  • FWIW I encountered the exact same problem a few months back and this is precisely what fixed it. 'Twas tricky because it only occurred in production, where there was lots of tracking garbage and many a cookie involved. – Matt Stein Jan 14 '16 at 19:57
  • 1
    Thanks very much, not seen this before but again it's only on staging (not local or live!). Fixed the issue perfectly :) – Chris Southam Jan 15 '16 at 10:12
  • Good deal! nginx is fun but its docs can be lacking ;) – RitterKnight Jan 15 '16 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.