HTTP 400 Bad Request

What 400 means

Common causes

• Malformed JSON: a trailing comma, single quotes, an unescaped newline, or a body stringified twice so the server receives a JSON string where it expected an object.
• A missing or wrong Content-Type, so the server's parser rejects the body, e.g. form-encoded data sent to a JSON-only endpoint.
• nginx 400 Bad Request: Request Header Or Cookie Too Large: bloated cookies or a huge Authorization token exceed large_client_header_buffers.
• nginx 400 The plain HTTP request was sent to HTTPS port: something is speaking plain HTTP to port 443.
• Invalid characters in the URL: unencoded spaces, a % not followed by two hex digits.
• A malformed header line, or no Host header on HTTP/1.1. Usually a hand-written client or a misconfigured proxy.
• Express with express.json(): invalid JSON throws a SyntaxError that becomes a 400 with type: 'entity.parse.failed'.

How to debug and fix a 400

curl -v https://api.example.com/orders \
  -H 'Content-Type: application/json' \
  --data '{"sku": "A-1", "qty": 2}'

# http or server block
large_client_header_buffers 4 16k;

app.use(express.json());

// ... routes ...

app.use((err, req, res, next) => {
  if (err.type === 'entity.parse.failed') {
    return res.status(400).json({ error: 'invalid_json', detail: err.message });
  }
  next(err);
});

const params = new URLSearchParams({ q: 'a&b c', page: '2' });
const res = await fetch(`/api/search?${params}`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ tags: ['x', 'y'] }),
});

Headers that matter with 400

Content-Type

Tells the server which parser to use. A mismatch is one of the most common 400 causes.

Content-Length

If it doesn't match the actual body size, the message framing is invalid and the server must reject it.

Cookie / Authorization

The usual culprits when headers exceed the server's buffer limits.

400 vs similar status codes

• 422 Unprocessable Content: The syntax is fine but the values are invalid. Use it for validation errors if you want to separate them from parse errors.
• 401 Unauthorized: The request is fine but has no valid credentials.
• 413 Content Too Large: The body is too big. nginx returns 400 for oversized headers but 413 for oversized bodies.
• 431 Request Header Fields Too Large: The precise code for oversized headers. Many servers, nginx included, send 400 instead.

SEO impact of 400

For Googlebot, every 4xx except 429 is treated the same way: the URL isn't indexed, and drops out if it was. If Search Console reports 400s, look for URL parameters or malformed links that your server rejects.

Related status codes

Looking for another code? Search the full HTTP status codes list, or read which code your API should return in the REST API status codes guide.

Learn more

Browse all developer guides →

Frequently Asked Questions