Microsoft.AspNetCore.Http.BadHttpRequestException – Request headers too long

The Microsoft.AspNetCore.Http.BadHttpRequestException with the message “Request headers too long” is an exception thrown by ASP.NET Core when the size of the HTTP request headers exceeds the server’s allowed limit. This typically occurs when the headers are excessively large, often due to too many or oversized cookies, authentication tokens, or custom headers.

---

Key Points

• This exception is specific to ASP.NET Core applications.
• It occurs when the combined size of the request headers exceeds the server’s configured limit.
• Common causes include large cookies, oversized authentication tokens, or excessive custom headers.

---

Common Causes

1. Large Cookies:

• The request includes many or very large cookies, often used for session management or tracking.

1. Oversized Authentication Tokens:

• The request includes a large authentication token (e.g., JWT) in the Authorization header.

1. Excessive Custom Headers:

• The request includes too many or very large custom headers.

1. Server Configuration:

• The server is configured with a low limit for the maximum size of request headers.

---

How to Fix

Client-Side Fixes

1. Reduce Header Size:

• Minimize the size of cookies, authentication tokens, and custom headers.
• Use shorter session IDs or tokens if possible.

1. Remove Unnecessary Headers:

• Avoid sending unnecessary or redundant headers.

1. Use Query Parameters:

• Move large data from headers to query parameters or the request body, if appropriate.

---

Server-Side Fixes

1. Increase Header Size Limit:

• Configure the server to allow larger request headers by increasing the MaxRequestHeadersTotalSize and MaxRequestHeaderCount limits.

   services.Configure<KestrelServerOptions>(options =>
   {
       options.Limits.MaxRequestHeadersTotalSize = 64 * 1024; // 64 KB
       options.Limits.MaxRequestHeaderCount = 100;
   });

2. Use Compression:

• Compress large headers (e.g., cookies or tokens) to reduce their size.

2. Handle Exceptions Gracefully:

• Use middleware or exception handling to catch BadHttpRequestException and return a meaningful error response.

   app.UseExceptionHandler(errorApp =>
   {
       errorApp.Run(async context =>
       {
           var exceptionHandlerPathFeature = context.Features.Get<IExceptionHandlerPathFeature>();
           if (exceptionHandlerPathFeature?.Error is BadHttpRequestException)
           {
               context.Response.StatusCode = StatusCodes.Status431RequestHeaderFieldsTooLarge;
               await context.Response.WriteAsync("Request headers are too large. Please reduce the size of your headers.");
           }
       });
   });

4. Log Errors:

• Log the exception details for debugging and monitoring.

   logger.LogError(exception, "Request headers too long.");

---

Example Scenario

Client Request

GET /api/data HTTP/1.1
Host: example.com
Cookie: sessionId=very-large-cookie-data; trackingId=another-large-cookie-data
Authorization: Bearer very-large-jwt-token
Custom-Header: very-large-custom-header-data

Server Response

HTTP/1.1 431 Request Header Fields Too Large
Content-Type: application/json

{
  "error": "Request headers too long",
  "message": "The size of the request headers exceeds the server's limit."
}

---

Debugging Tips

1. Inspect Headers:

• Use tools like Postman, Fiddler, or browser developer tools to inspect the request headers.

1. Check Header Size:

• Calculate the total size of the request headers to identify which headers are contributing to the issue.

1. Test with Reduced Headers:

• Test the API with fewer or smaller headers to confirm the issue is related to header size.

---