# Custom page for 400 (Bad Request)

**URL:** <https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530>\
**Category:** NGINX\
**Created:** [December 14, 2010, 5:42pm UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530 "2010-12-14T17:42:22Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/77aa72/32.png) [@Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/u/Dobai-Pataky_BSSSSl)\
**Post date:** [December 14, 2010, 5:42pm UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530/1 "2010-12-14T17:42:22Z")

</div>

Hello everyone!

I have a decent number of hits with very large cookies. It was a bug of  
our application and it’s fixed now, but we have to do something with  
these clients, because all they are seeing now is the standard 400 Bad  
Request page. I tried adding

```auto
error_page 400 /errors/400.html;
```

hoping that I would delete the cookies by javascript or some other way,  
but I still get the standard page and connection reset.

Is there any way to override that or is there any other way to flush  
those huge cookies?

Cheers!  
Denis.

Posted at Nginx Forum:

> **[Custom page for 400 (Bad Request)](https://forum.nginx.org/read.php?2,158557,158557#msg-158557)**
>
> Hello everyone! I have a decent number of hits with very large cookies. It was a bug of our application and it's fixed now, but we have to do something with these clients, because all they are seeing now is the standard 400 Bad Request page. I tried...

---

<div class="post-metadata">

**Author:** ![denis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@denis](https://www.ruby-forum.com/u/denis)\
**Post date:** [December 14, 2010, 6:13pm UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530/2 "2010-12-14T18:13:13Z")

</div>

Hello!

On Tue, Dec 14, 2010 at 10:16:11AM -0500, Denis wrote:

> but I still get the standard page and connection reset.
> 
> Is there any way to override that or is there any other way to flush  
> those huge cookies?

This should be added to default server, as error 400 is generated  
before any server\_name matching occurs.

Note that you may also bump client\_header\_buffer\_size /  
large\_client\_header\_buffers if you want cookies in question to be  
actually accepted and processed (this should be done in default  
server, too, or at http level).

> **[GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki...](https://github.com/nginxinc/nginx-wiki)**
>
> ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com

Maxim D.

---

<div class="post-metadata">

**Author:** ![denis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@denis](https://www.ruby-forum.com/u/denis)\
**Post date:** [December 14, 2010, 6:34pm UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530/3 "2010-12-14T18:34:35Z")

</div>

> [@](#):
>
> This should be added to default server, as error 400 is generated  
> before any server\_name matching occurs.

Yep, I added it to the default server. At least, it’s listening as

```auto
listen 80 default;
```

> [@](#):
>
> Note that you may also bump client\_header\_buffer\_size /  
> large\_client\_header\_buffers if you want cookies in question to be  
> actually accepted and processed (this should be done in default  
> server, too, or at http level).

That’s exactly what I’m bumping. Sorry, I should have made it more clear  
in my first post. I don’t want to make my large\_client\_header\_buffer 1  
megabyte and I need some kind of way to fall back gracefully when a  
client appears with 1Mbyte cookie. Like show him a page saying “your  
cookie is too large, please delete it” or delete it in javascript.  
But the problem is, I either get that hardcoded simple page or get http  
response with no response body at all.

```auto
$ curl http://foobar.com/ -b hugecookies.jar
HTTP/1.1 400 Bad Request
Server: nginx
Date: Tue, 14 Dec 2010 17:29:07 GMT
Content-Type: text/html; charset=EUC-JP
Content-Length: 237
Connection: close

curl: (55) Send failure: Connection reset by peer
$
```

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,158557,158603#msg-158603](http://forum.nginx.org/read.php?2,158557,158603#msg-158603)

---

<div class="post-metadata">

**Author:** ![denis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@denis](https://www.ruby-forum.com/u/denis)\
**Post date:** [December 14, 2010, 11:36pm UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530/4 "2010-12-14T23:36:01Z")

</div>

On Tue, Dec 14, 2010 at 12:33:02PM -0500, Denis wrote:

> [quote]  
> But the problem is, I either get that hardcoded simple page or get http  
> curl: (55) Send failure: Connection reset by peer  
> $  
> [/code]

The attached patch allows HTTP lingering close for 400 responses.  
However, it will not be included in next releases: I’m going to  
introduce a special code, say 490, for long HTTP header lines as  
it’s already done for SSL errors (495, 496, and 497). Then you can  
set expliclty

```
error_page 490 =200 /large_cookie.html;

```

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![denis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@denis](https://www.ruby-forum.com/u/denis)\
**Post date:** [December 14, 2010, 11:40pm UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530/5 "2010-12-14T23:40:24Z")

</div>

On Wed, Dec 15, 2010 at 01:35:17AM +0300, Igor S. wrote:

> > [/code]  
> > client appears with 1Mbyte cookie. Like show him a page saying "your  
> > Connection: close
> 
> ```
> error_page 490 =200 /large_cookie.html;
> 
> ```

Forgot the patch.

---

<div class="post-metadata">

**Author:** ![denis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@denis](https://www.ruby-forum.com/u/denis)\
**Post date:** [December 15, 2010, 10:46am UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530/6 "2010-12-15T10:46:48Z")

</div>

Whoa!  
That works perfectly!  
Thank you very much Igor! Really appreciate your work.

Cheers!  
Denis.

Posted at Nginx Forum:

> **[Re: Custom page for 400 (Bad Request)](https://forum.nginx.org/read.php?2,158557,158804#msg-158804)**
>
> Hello everyone! I have a decent number of hits with very large cookies. It was a bug of our application and it's fixed now, but we have to do something with these clients, because all they are seeing now is the standard 400 Bad Request page. I tried...

---

<div class="post-metadata">

**Author:** ![denis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@denis](https://www.ruby-forum.com/u/denis)\
**Post date:** [December 15, 2010, 12:22pm UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530/7 "2010-12-15T12:22:25Z")

</div>

Hi,

Nice patch. I don’t know if ‘Header line too long’ might be better than  
‘Too long header line’. Both make sense, but the former sounds a bit  
better to me.

Just an idea.

Cheers,

Marcus.

---

<div class="post-metadata">

**Author:** ![denis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@denis](https://www.ruby-forum.com/u/denis)\
**Post date:** [December 15, 2010, 12:34am UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530/8 "2010-12-15T00:34:16Z")

</div>

On Wed, Dec 15, 2010 at 01:35:17AM +0300, Igor S. wrote:

> > [/code]  
> > client appears with 1Mbyte cookie. Like show him a page saying "your  
> > Connection: close
> 
> ```
> error_page 490 =200 /large_cookie.html;
> 
> ```

The new patch introduce the new error code 494.  
It can be used as

```
  error_page 494 =200 /large_cookie.html;

```

If it’s not handled via error\_page, it returns 400 code.

---

<div class="post-metadata">

**Author:** ![denis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@denis](https://www.ruby-forum.com/u/denis)\
**Post date:** [December 15, 2010, 12:40pm UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530/9 "2010-12-15T12:40:40Z")

</div>

On Wed, Dec 15, 2010 at 02:35:58PM +0300, Igor S. wrote:

> May be “Header line is too long” ?  
> According to RFC 2616 413 and 414 messages has no “is”:

“Request Entity Too Large”  
“Request-URI Too Long”

So “Header line too long” should be OK.

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![denis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@denis](https://www.ruby-forum.com/u/denis)\
**Post date:** [December 15, 2010, 12:37pm UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530/10 "2010-12-15T12:37:30Z")

</div>

On Wed, Dec 15, 2010 at 01:21:19PM +0200, Eugaia wrote:

> Hi,
> 
> Nice patch. I don’t know if ‘Header line too long’ might be better than  
> ‘Too long header line’. Both make sense, but the former sounds a bit  
> better to me.
> 
> Just an idea.

May be “Header line is too long” ?

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![denis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@denis](https://www.ruby-forum.com/u/denis)\
**Post date:** [December 15, 2010, 12:51pm UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530/11 "2010-12-15T12:51:20Z")

</div>

On Wed, Dec 15, 2010 at 01:41:42PM +0200, Eugaia wrote:

> > May be “Header line is too long” ?  
> > I think ‘Header line too long’ would be more normal for this sort of  
> > thing, as they tend to be shortened English. ‘Header too big’ is  
> > another alternative, or perhaps even ‘Header or cookie too big’. Adding  
> > the ‘cookie’ information may be useful to people who wouldn’t think to  
> > look at cookies when just getting a message about headers.

Yes, mention of “cookie” is useful here, since this is the main cause  
of these errors. “Header line or cookie too big”. I use “line”  
because nginx has another couse of 400 error: large header.  
“Header line is too long” is logged when a single line of client header  
is bigger than a buffer in large\_client\_header\_buffers.  
“Header is too large” is logged when sum of all header lines are bigger  
than client\_header\_buffer\_size plus large\_client\_header\_buffers.  
Probably this reason should cause 494 error too. And the resulting  
message should be as you have suggested: “Request header or cookie too  
big”.

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![denis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@denis](https://www.ruby-forum.com/u/denis)\
**Post date:** [December 15, 2010, 12:58pm UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530/12 "2010-12-15T12:58:58Z")

</div>

Hi,

On 15/12/2010 13:50, Igor S. wrote:

> Yes, mention of “cookie” is useful here, since this is the main cause  
> of these errors. “Header line or cookie too big”. I use “line”  
> because nginx has another couse of 400 error: large header.  
> “Header line is too long” is logged when a single line of client header  
> is bigger than a buffer in large\_client\_header\_buffers.  
> “Header is too large” is logged when sum of all header lines are bigger  
> than client\_header\_buffer\_size plus large\_client\_header\_buffers.  
> Is this for a single header, all the headers or either? It might be  
> useful to have ‘Headers too large’ if more than a single header is  
> included in the calculation.  
> Probably this reason should cause 494 error too. And the resulting  
> message should be as you have suggested: “Request header or cookie too big”.  
> Sounds good to me.

It might also be useful to specify ‘Cookie too large’ in the log file,  
if it is the cookie that is too large.

Marcus.

---

<div class="post-metadata">

**Author:** ![denis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@denis](https://www.ruby-forum.com/u/denis)\
**Post date:** [December 15, 2010, 12:42pm UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530/13 "2010-12-15T12:42:33Z")

</div>

On 15/12/2010 13:35, Igor S. wrote:

> On Wed, Dec 15, 2010 at 01:21:19PM +0200, Eugaia wrote:
> 
> > Hi,
> > 
> > Nice patch. I don’t know if ‘Header line too long’ might be better than  
> > ‘Too long header line’. Both make sense, but the former sounds a bit  
> > better to me.
> > 
> > Just an idea.  
> > May be “Header line is too long” ?  
> > I think ‘Header line too long’ would be more normal for this sort of  
> > thing, as they tend to be shortened English. ‘Header too big’ is  
> > another alternative, or perhaps even ‘Header or cookie too big’. Adding  
> > the ‘cookie’ information may be useful to people who wouldn’t think to  
> > look at cookies when just getting a message about headers.

Marcus.

---

<div class="post-metadata">

**Author:** ![denis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@denis](https://www.ruby-forum.com/u/denis)\
**Post date:** [December 15, 2010, 2:39pm UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530/14 "2010-12-15T14:39:36Z")

</div>

On Wed, Dec 15, 2010 at 03:09:14PM +0300, Igor S. wrote:

> > > “Header is too large” is logged when sum of all header lines are bigger  
> > > useful to have ‘Headers too large’ if more than a single header is  
> > > The header line name and about 1800 value charecters are logged.  
> > > New patch verision.

---

<div class="post-metadata">

**Author:** ![denis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@denis](https://www.ruby-forum.com/u/denis)\
**Post date:** [December 15, 2010, 1:10pm UTC](https://www.ruby-forum.com/t/custom-page-for-400-bad-request/200530/15 "2010-12-15T13:10:16Z")

</div>

On Wed, Dec 15, 2010 at 01:57:58PM +0200, Eugaia wrote:

> Is this for a single header, all the headers or either?  
> I have looked in the sources.  
> “client sent too large request” is logged if all request headers can not  
> be read in client\_header\_buffer\_size plus large\_client\_header\_buffers.  
> "client sent too long header line: “…” is logged if a single header  
> line  
> does not fit in a buffer of large\_client\_header\_buffers.

> It might be  
> useful to have ‘Headers too large’ if more than a single header is  
> included in the calculation.
> 
> > Probably this reason should cause 494 error too. And the resulting  
> > message should be as you have suggested: “Request header or cookie too big”.  
> > Sounds good to me.

The current edition is “Request header or cookie too large”.

> It might also be useful to specify ‘Cookie too large’ in the log file,  
> if it is the cookie that is too large.

The header line name and about 1800 value charecters are logged.

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**