HTTP
HTTP 400Bad Request
HTTP 400 Bad Request means the server rejected the request because it was malformed or invalid: a bad URL, an oversized or corrupted cookie, an invalid header, or a request body the application could not parse. It is a client-side problem by definition, although the "client" may be a script or another server.
What 400 means
The server understood enough to know the request is unacceptable and will not process it. Unlike 500, nothing went wrong on the server; unlike 404, the problem is the request itself rather than the resource.
Common causes
| Cause | Who fixes it |
|---|---|
| Malformed URL (unescaped characters, bad percent-encoding) | User or the code building the URL |
| Cookies or headers too large for the server's buffer | User clears cookies; operator raises limits |
| Invalid JSON or XML body, wrong Content-Type | Developer of the client |
| Missing required parameter (application-defined 400) | Developer of the client |
| Corrupted upload or truncated body | Network or client |
HTTP/1.1 request without a Host header | Client tooling |
| Deliberate rejection by a WAF or proxy | Operator |
For visitors
- Check the URL for stray characters, spaces or unbalanced quotes; the URL parser shows the components.
- Clear cookies and cached data for the site.
- Try a private window or another browser to rule out extensions.
- If the page works for others, the problem is local; if not, the site has a bug.
For developers
- Read the response body; well-designed servers explain what was wrong.
- Reproduce with curl to remove the browser from the picture:
curl -v -X POST https://api.example.com/items -H "Content-Type: application/json" -d "{\"name\":\"test\"}"- Validate encoding: JSON bodies must be UTF-8; form bodies must be percent-encoded (URL encoder); base64 fields must have valid padding (Base64 tool).
- Check server logs; nginx and Apache record the reason for protocol-level 400s.
Frequently asked questions
How do I fix a 400 as a visitor?
Retype the URL, clear cookies for the site (oversized cookies are the most common cause on large sites), and try another browser or private window. If it persists for everyone, the site is at fault.
"400 Bad Request: Request Header Or Cookie Too Large" — what is it?
nginx rejecting a request whose headers exceed its buffer (8 KB by default). Usually the site has accumulated large cookies in your browser; clearing them fixes it. Site operators can raise large_client_header_buffers.
Should an API return 400 or 422 for validation errors?
400 for requests the server cannot parse or that violate the protocol; 422 Unprocessable Content for well-formed requests with semantically invalid data. Many APIs use 400 for both; be consistent and include a body explaining the problem.