devkult_
tools29converters34
home/http/400

400 Bad Request

4xx client error

The server can't process the request because something about it is malformed or invalid.

400 is the generic client error: something about the request is wrong, and sending it again unchanged will fail again. It covers broken syntax — invalid JSON, a malformed header — and many APIs also use it for validation failures. A useful 400 says exactly what was wrong in its body.

Class4xx Client Error
Retry?No — change the request first
Cacheable by defaultNo — only with explicit Cache-Control
Response bodyAllowed
Defined inRFC 9110 §15.5.1 — 400 Bad Request
Example response
HTTP/1.1 400 Bad Request
Content-Type: application/json
Content-Length: 23

{"error":"Bad Request"}

Common causes

  • Invalid JSON, or a body that doesn't match the Content-Type.
  • Missing required query parameters or fields.
  • Malformed or oversized cookies — nginx reports '400 Bad Request: Request Header Or Cookie Too Large'.
  • Invalid characters in the URL, or a double-encoded URL.

How to fix it

  1. Validate the body: run JSON.parse on it locally or paste it into a JSON validator.
  2. Check that the Content-Type matches the body (application/json for JSON).
  3. If one site fails in one browser, clear that site's cookies.
  4. On the server, return a machine-readable error naming the invalid field — RFC 9457 application/problem+json is a good format.

Useful here: JSON Validator · URL Encoder / Decoder

Send a 400 from your server

Express
res.status(400).json({ error: "Bad Request" });
Next.js route handler
return Response.json({ error: "Bad Request" }, { status: 400 });
Flask
return {"error": "Bad Request"}, 400
Go net/http
http.Error(w, "Bad Request", http.StatusBadRequest)
nginx
return 400;

Check what a URL returns

Print just the status line from the command line, or check a whole list of URLs at once, with their response headers, in the HTTP Status Checker.

curl -sI https://example.com/your-path | head -n 1

Frequently asked questions

400 vs 422?

400 when the request can't be parsed or is structurally wrong; 422 when it parses but the content fails validation, like an email field that isn't an email. Many APIs use 400 for both — just be consistent.

Why do I get 400 in one browser only?

Usually a corrupt or oversized cookie for that site. Clear the site's cookies and reload.

Headers used with 400
Related status codes