<p>Add this to your nginx <code>server</code> block:</p>

<pre><code>server {
  ...
  large_client_header_buffers 4 16k;
  ...
} 
</code></pre>

<p>and restart nginx. The default is 8k. If you have a lot of headers, beefing that value up should resolve it otherwise you may want to play with <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_buffer_size" rel="nofollow"><code>client_header_buffer_size</code></a> as well.</p>

CC BY-SA 3.0
2016-01-14T19:57:04.770Z
FWIW I encountered the exact same problem a few months back and this is precisely what fixed it. 'Twas tricky because it only occurred in production, where there was lots of tracking garbage and many a cookie involved.
Matt Stein
CC BY-SA 3.0
2016-01-15T10:12:53.213Z
Thanks very much, not seen this before but again it's only on staging (not local or live!). Fixed the issue perfectly :)
Chris Southam
CC BY-SA 3.0
2016-01-15T20:50:09.907Z
Good deal! nginx is fun but its docs can be lacking ;)
RitterKnight
CC BY-SA 3.0
2016-01-14T18:20:36.697Z
2016-01-14T18:29:45.477Z
2016-01-14T18:29:45.477Z
RitterKnight
<p>On attempting to login into either a front-end account or admin account I'm hit by:</p>

<p>400 Bad Request<br>
Request Header Or Cookie Too Large<br>
nginx/1.8.0</p>

<p>It's only happened recently but running the latest Craft CMS v2.5.2757 and from looking at the cookies created during login I think it's possibly related to CSRF protection as deleting the top cookie in the list below fixes the issue until you log in again.</p>

<p><a href="https://i.sstatic.net/DPjKR.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/DPjKR.png" alt="Google Console Log"></a></p>

<p>Running a few other Craft sites on the same staging nGinx server without the same issue, and even the same codebase is running another site without issue.</p>

<p>Any thoughts please?!</p>

<nginx>
400 Bad Request on account or admin login
# 400 Bad Request on account or admin login

(Asked by: username_0 on 2016-01-14)

On attempting to login into either a front-end account or admin account I'm hit by:

400 Bad Request  
Request Header Or Cookie Too Large  
nginx/1.8.0

It's only happened recently but running the latest Craft CMS v2.5.2757 and from looking at the cookies created during login I think it's possibly related to CSRF protection as deleting the top cookie in the list below fixes the issue until you log in again.

[![Google Console Log](https://i.sstatic.net/DPjKR.png)](https://i.sstatic.net/DPjKR.png)

Running a few other Craft sites on the same staging nGinx server without the same issue, and even the same codebase is running another site without issue.

Any thoughts please?!

**Tags:** nginx

---

## 1 answers

### Answer by username_1 on 2016-01-14. Score: 3 | Accepted answer

Add this to your nginx server block:
server {
  ...
  large_client_header_buffers 4 16k;
  ...
} 

and restart nginx. The default is 8k. If you have a lot of headers, beefing that value up should resolve it otherwise you may want to play with client_header_buffer_size as well.

> **Comments:**
> **username_2**: FWIW I encountered the exact same problem a few months back and this is precisely what fixed it. 'Twas tricky because it only occurred in production, where there was lots of tracking garbage and many a cookie involved.  
> **username_0**: Thanks very much, not seen this before but again it's only on staging (not local or live!). Fixed the issue perfectly :)  
> **username_1**: Good deal! nginx is fun but its docs can be lacking ;)  

---

