LightAtom

400 Bad Request: What It Means and How to Fix It

The server rejected the request as malformed: a broken URL, cookies that are too large or corrupted, or invalid data sent by an app.

400 Bad Request

The server received your request but couldn't make sense of it: something in the address, the cookies or the data sent was invalid.

Quick checks

  • Check the address for odd characters or a stray % sign.
  • Try a private window. If it works there, your cookies for the site are the problem.
  • If an upload fails, check the file size and type.

If you’re visiting the site

  1. Clear the site's cookies

    1. Chrome: click the icon left of the address › Cookies and site data › Manage on-device site data › delete.
    2. Safari: Safari › Settings › Privacy › Manage Website Data, search for the site, Remove.
    3. Reload and log in again. Oversized or corrupted cookies are the most common cause (“Request Header Or Cookie Too Large”).

  2. Fix the address

    1. Retype it instead of using a mangled link; remove anything after a ? if it looks garbled.

If you run the site

  1. Log the reason

    1. Return a body that says what was wrong (which field, which header); a bare 400 is hard to debug.

  2. Check header and body limits

    1. nginx large_client_header_buffers and similar limits reject big cookies with 400.
    2. Validate JSON and form data, and check Content-Type matches the body.

Still not working?

If a 400 keeps happening after clearing cookies and in another browser, report the exact action to the site; the request their app builds may be broken.

See what’s happening

LightAtom's connections view shows which app on your Mac talks to which server, a starting point when a background app keeps getting 400 errors.

Frequently asked questions

What causes 400 Bad Request?

A request the server can't parse: a malformed URL, cookies or headers that are too large or corrupted, or invalid data in a form or API call.

Why does clearing cookies fix 400 Bad Request?

Sites can accumulate many or large cookies until the request header exceeds the server's limit. Deleting them shrinks the request back under it.

Is 400 Bad Request a virus?

No. It's an ordinary error from a website about a request it didn't accept.

What is the difference between 400 and 422?

400 means the request is malformed. 422 means it's well-formed but the data fails validation, like a missing required field.

Related errors and tools

Related

LightAtom team

The people who build LightAtom, a network monitor for macOS.