The 400 Bad Request error is one of the most common client-side HTTP errors on the web. Unlike a 404 (which means a page does not exist) or a 500 (which points to a server problem), a 400 means the server received your request but could not understand it because something in the request itself was malformed. In this guide we will explain what causes it, how to fix it as a user, and how developers should handle it on the server side.<\/p>\n\n\n\n
When your browser or an application sends a request to a web server, that request has to follow a specific structure defined by the HTTP protocol. If any part of it is broken \u2014 a corrupted cookie, an oversized header, invalid characters in the URL, or malformed JSON in the body \u2014 the server rejects the request before processing it and returns a 400 status code.<\/p>\n\n\n\n
It belongs to the 4xx family of HTTP status codes, which are reserved for client errors. This is the same family as the 401 and 403 errors<\/a> and the well-known 404 Not Found error<\/a>. The key distinction is that a 400 is a generic “the request is broken” signal, while the others point to more specific situations. You can see the full list on the official MDN HTTP status reference<\/a>.<\/p>\n\n\n\n The table below shows how the 400 compares to its closest relatives in the 4xx and 5xx ranges. Seeing them side by side makes it clear when each one applies.<\/p>\n\n\n\nHow the 400 error fits among other HTTP status codes<\/h2>\n\n\n\n
| Code<\/th>\n | Meaning<\/th>\n | Typical cause<\/th>\n | Side at fault<\/th>\n <\/tr>\n <\/thead>\n |
|---|---|---|---|
| 400<\/td>\n | Bad Request<\/td>\n | Malformed syntax, bad cookie, invalid header<\/td>\n | Client<\/td>\n <\/tr>\n |
| 401<\/td>\n | Unauthorized<\/td>\n | Authentication missing or invalid<\/td>\n | Client<\/td>\n <\/tr>\n |
| 403<\/td>\n | Forbidden<\/td>\n | Authenticated but lacks permission<\/td>\n | Client<\/td>\n <\/tr>\n |
| 404<\/td>\n | Not Found<\/td>\n | Resource does not exist on the server<\/td>\n | Client<\/td>\n <\/tr>\n |
| 500<\/td>\n | Internal Server Error<\/td>\n | Server-side fault or misconfiguration<\/td>\n | Server<\/td>\n <\/tr>\n <\/tbody>\n<\/table>\n\n\n\nMost common causes of the 400 error<\/h2>\n\n\n\nA 400 Bad Request can be triggered by several different problems. The chart below shows roughly how often each cause appears in practice, based on typical support-ticket patterns \u2014 useful for knowing where to look first.<\/p>\n\n\n\n \n\n \n Corrupted browser cookies<\/span>35%<\/span><\/div>\n <\/div><\/div>\n <\/div>\n\n \n Invalid URL \/ bad characters<\/span>25%<\/span><\/div>\n <\/div><\/div>\n <\/div>\n\n \n Headers too large<\/span>18%<\/span><\/div>\n <\/div><\/div>\n <\/div>\n\n \n Malformed request body (JSON\/form)<\/span>14%<\/span><\/div>\n <\/div><\/div>\n <\/div>\n\n \n Oversized file upload<\/span>8%<\/span><\/div>\n <\/div><\/div>\n <\/div>\n\n<\/div>\n\n\n\n As the chart shows, corrupted cookies are by far the most frequent culprit. Cookies are small files your browser stores to keep you logged in and remember preferences; when one becomes corrupted or expired, the server may reject the entire request. You can read more about how they work on the MDN cookies guide<\/a>.<\/p>\n\n\n\n |