400 Bad Request

The server cannot process the request because it is malformed or invalid.

400 at a glance

Code: 400
Name: Bad Request
Class: 4xx Client error
Status: IANA-registered standard code
Defined in: RFC 9110, Section 15.5.1
Cacheable by default: No by default. Caches store it only when the response carries explicit freshness (Cache-Control max-age, s-maxage or Expires).

What 400 means

400 Bad Request is the generic client-error status: the server thinks the request is wrong in a way it cannot (or will not) describe more precisely, such as invalid syntax, a bad header, or framing it cannot parse. Many APIs also use it for invalid parameters, although 422 is more specific for well-formed but semantically invalid bodies.

What typically causes a 400

nginx shows "400 Bad Request: Request Header Or Cookie Too Large" when cookies or headers exceed large_client_header_buffers (internally code 494).
nginx "The plain HTTP request was sent to HTTPS port" when plain HTTP hits a TLS listener (internally 497).
Invalid JSON, missing required parameters or wrong types in API requests.
Malformed Host header, invalid characters in the URL, or a request smuggling-style conflict between Content-Length and Transfer-Encoding.
AWS ALB and Cloudflare return 400 for requests that violate HTTP syntax before they reach your app.

Fix it on the server

Return a body that says what was wrong (RFC 9457 application/problem+json is a good format).
For header-size errors raise large_client_header_buffers in nginx or LimitRequestFieldSize in Apache, or reduce cookie size.
Use 422 for validation errors and 415 for wrong Content-Type so clients can tell cases apart.

Fix it as a client or visitor

Clear cookies for the site: oversized or corrupted cookies are the most common cause in browsers.
Check the URL for unencoded spaces or special characters, and the JSON body for syntax errors.
Compare your request with a working one: curl -v shows exactly what is sent.

Headers that go with 400

Header	Role
`Content-Type`	Often `application/problem+json` for API errors (RFC 9457).

Example response

HTTP/1.1 400 Bad Request
Content-Type: application/problem+json

{"type": "about:blank", "title": "Bad Request", "detail": "Body is not valid JSON"}