# HTTP 400 Bad Request — Meaning, Causes & Fixes

> The server can't process the request because something about it is malformed or invalid.

400 is the generic client error: something about the request is wrong, and sending it again unchanged will fail again. It covers broken syntax — invalid JSON, a malformed header — and many APIs also use it for validation failures. A useful 400 says exactly what was wrong in its body.

- Class: 4xx Client Error
- Retry: No — change the request first
- Cacheable by default: no
- Defined in: [RFC 9110 §15.5.1 — 400 Bad Request](https://www.rfc-editor.org/rfc/rfc9110.html#section-15.5.1)

## Example response

```http
HTTP/1.1 400 Bad Request
Content-Type: application/json
Content-Length: 23

{"error":"Bad Request"}
```

## Common causes

- Invalid JSON, or a body that doesn't match the `Content-Type`.
- Missing required query parameters or fields.
- Malformed or oversized cookies — nginx reports '400 Bad Request: Request Header Or Cookie Too Large'.
- Invalid characters in the URL, or a double-encoded URL.

## How to fix it

1. Validate the body: run `JSON.parse` on it locally or paste it into a JSON validator.
2. Check that the `Content-Type` matches the body (`application/json` for JSON).
3. If one site fails in one browser, clear that site's cookies.
4. On the server, return a machine-readable error naming the invalid field — RFC 9457 `application/problem+json` is a good format.

## Send a 400 from your server

### Express

```
res.status(400).json({ error: "Bad Request" });
```

### Next.js route handler

```
return Response.json({ error: "Bad Request" }, { status: 400 });
```

### Flask

```
return {"error": "Bad Request"}, 400
```

### Go net/http

```
http.Error(w, "Bad Request", http.StatusBadRequest)
```

### nginx

```
return 400;
```

## FAQ

### 400 vs 422?

400 when the request can't be parsed or is structurally wrong; 422 when it parses but the content fails validation, like an email field that isn't an email. Many APIs use 400 for both — just be consistent.

### Why do I get 400 in one browser only?

Usually a corrupt or oversized cookie for that site. Clear the site's cookies and reload.

## Related status codes

- [422 Unprocessable Content](https://www.devkult.com/http/422.md)
- [413 Content Too Large](https://www.devkult.com/http/413.md)
- [431 Request Header Fields Too Large](https://www.devkult.com/http/431.md)
- [415 Unsupported Media Type](https://www.devkult.com/http/415.md)

Open the interactive page: https://www.devkult.com/http/400