A 400 response behind Varnish is usually a request that one of the proxies rejected before it reached your application. Find the emitting hop first, then check HTTP/1.1 framing, the Host header, PROXY-protocol agreement, and oversized or malformed headers. Nginx and Varnish enforce different limits, so changing the wrong buffer can leave the failure untouched.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Clean up unnecessary cookies and forwarded headers before raising limits. If legitimate traffic still needs more room, increase only the specific Nginx or Varnish setting implicated by the logs, reload safely, and retest the exact request.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Identify which hop generated the 400
The public status code alone does not tell you whether Nginx, Varnish, or another listener produced the response. A request can be rejected while entering Varnish, while Varnish forwards it to Nginx, or while Nginx is acting as the public listener. Treat the first task as attribution, not tuning.
Compare the public endpoint with each hop
- Send the failing request to the public endpoint and record the status, response headers, response body, timestamp, and any request ID.
- Where your network layout permits, send the same request directly to the Varnish listener, the Nginx listener, and the origin. Preserve the method, path, protocol version, and headers when comparing tests.
- Match the timestamp and request ID against Nginx access and error logs and against Varnish Shared Log (VSL) output from
varnishlog. - Check whether the request reached the next hop. A Varnish parser rejection commonly appears with
BogoHeader,LostHeader,RespStatus 400, or a related request record. If no Nginx access entry exists for that request, the rejection occurred before Nginx handled it.
Varnish documentation describes malformed or over-limit client headers as an immediate transaction abandonment with a 400 response. Nginx has its own 400 conditions, including an individual request-header field that cannot fit in one configured buffer.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Use response fingerprints carefully
Response body wording and headers can provide clues, but they are not proof: custom error pages may hide the component that generated the status. Logs and a direct-hop comparison are more reliable than the appearance of the error page.
Understand the failure classes before changing a limit
Several different problems are commonly reported as “Nginx 400 behind Varnish.” Separate them so that a targeted fix does not create a larger attack surface or waste memory.
- Malformed request syntax: illegal whitespace, control characters, missing header names, or malformed continuation lines can be rejected by Varnish’s parser.
- Missing HTTP/1.1
Host: Varnish’s built-in VCL returns 400 when it receives an HTTP/1.1 request without aHostheader. - Protocol framing mismatch: a listener expecting PROXY protocol may receive ordinary HTTP, or a peer may send a different PROXY version. TLS bytes sent to a plain-HTTP listener, or plain HTTP sent to a TLS-only listener, is another framing error.
- One oversized header field: a single
Cookie,Authorization, tracing, or forwarded header can exceed the per-field capacity. - Total request or header-count overflow: the complete request can exceed Varnish’s request-size limit, or the number of header lines can exceed its count limit.
- Request-line overflow: in Nginx, a request line that exceeds one large header buffer is associated with a 414 response rather than the per-field 400 case.
Do not treat a backend response-header problem as the same incident. When Varnish cannot parse an origin response or reports response-header overflow, the usual result is a 503 investigation involving BogoHeader or FetchError, not a client-side 400.
Step-by-step diagnostic workflow
1. Reproduce the exact request
Capture the method, path, HTTP version, complete request headers, cookies, and response details for a failing transaction. Test with the same authentication state when possible; a request that fails only for one user may carry a much larger cookie or authorization value than an anonymous request.
Run a controlled request with verbose client output and compare it with a minimal request to the same path. The minimal request establishes whether routing works when optional headers and cookies are removed. Keep timestamps synchronized across the proxy and origin hosts so that log correlation is meaningful.
2. Verify request syntax and framing
- For HTTP/1.1, confirm that the request has exactly one valid
Hostheader. A missingHostis an explicit Varnish 400 condition. - Inspect whitespace, control characters, header names, and continuation lines. Clients and upstream proxies that emit illegal syntax can trigger Varnish
BogoHeaderdiagnostics. - If PROXY protocol is enabled, verify both sides of that connection agree on whether it is present and which version is used. A peer that sends ordinary HTTP to a PROXY-enabled listener, or the reverse, can produce an HTTP/1.1 400.
- Confirm where TLS terminates. Ensure that encrypted traffic is sent only to a TLS listener and that a plain-HTTP request is not sent to a TLS-only port.
3. Inspect size and count
Measure the largest individual header, the total request headers, the request line, and the number of header lines. Pay special attention to repeated Cookie values, long Authorization credentials, accumulated X-Forwarded-* chains, tracing headers, and application-specific headers added by several proxies.
Recommended Free Tools
For Nginx, ask whether one field can fit inside one large_client_header_buffers buffer. For Varnish, compare the observed request with http_req_hdr_len (one header length), http_req_size (the complete request), and http_max_hdr (header-line count). HTTP/2 failures require checking the configured h2_max_header_list_size as well.
4. Remove data at its source
Delete stale cookies and duplicated cookie names, shorten or stop appending forwarded-header chains, and correct the client or upstream proxy that emits malformed syntax. Removing data lowers memory use at every hop and avoids imposing a larger limit on requests that should not be large.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
5. Raise only the Nginx capacity that the evidence requires
The Nginx defaults documented for large_client_header_buffers are four buffers of 8 KB. A request-header field cannot exceed the size of one buffer; increasing the number of buffers does not make an individual line longer. If a legitimate field is larger than 8 KB, increase the buffer size, not merely the count.
For example, a narrowly scoped configuration can look like this:
Free tools Windows power users keep installed
One-click scans. No signup required.
http {
client_header_buffer_size 4k;
large_client_header_buffers 4 16k;
server {
listen 80;
# proxy_pass and normal Varnish routing here
}
}Use the smallest values that accommodate the measured request. Place the directive at the appropriate http or server scope for the affected traffic rather than changing unrelated virtual hosts. Test the configuration with nginx -t, reload through your normal change-control procedure, and repeat the exact failing request.
6. Raise only the Varnish limit named by its logs
Varnish’s documented defaults are:
| Parameter | Default | What it limits |
|---|---|---|
http_max_hdr |
64 header lines | Number of request header lines |
http_req_hdr_len |
8 KB | Length of an individual request header |
http_req_size |
32 KB | Total request size |
Apply changes through the startup parameter or service configuration used by your installed Varnish version. An example set of parameters is:
-p http_max_hdr=96
-p http_req_hdr_len=16k
-p http_req_size=64kThese numbers are examples of the parameter syntax, not universal recommendations. Change only the parameter associated with the observed overflow. Varnish documentation warns that larger limits do not guarantee flawless operation and that larger workspaces consume more memory. Confirm the exact Varnish release and edition before selecting values, then restart or reload using the service’s supported method.
7. Re-test the whole path
After a change, verify that the public request reaches the intended backend, that Nginx and Varnish logs no longer show the rejection, and that normal requests still receive the expected response. Keep a test for the previously failing large request and a minimal request so that a successful workaround does not hide a routing or framing regression.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Nginx header-buffer behavior in detail
Why one long field still fails
Nginx allocates a normal client-header buffer and a set of large buffers. The important rule is per field: one request-header field must fit completely inside a single large buffer. A request containing many moderate-size fields may fit when no field is individually too long; one very long cookie line can still produce 400 even when the total number of buffers is increased.
Choosing the two Nginx directives
client_header_buffer_sizecontrols the initial buffer used for reading client request headers.large_client_header_buffersdefines the number and size of buffers available for larger request lines and fields. The documented default is4 8k.
Use measurements from the failing request to choose a size. Do not assume that a larger request line and a larger header field need the same change; Nginx associates an overlong request line with 414, while an individual field that exceeds one large buffer produces 400.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Varnish limits and diagnostics
Interpreting VSL evidence
BogoHeader generally points toward malformed header syntax, while LostHeader and request records showing RespStatus 400 help identify client-side parsing or limit failures. Read the surrounding transaction records rather than changing a parameter solely because a 400 appeared.
Header count versus header bytes
http_max_hdr addresses the number of header lines; it does not make a single line longer. http_req_hdr_len addresses an individual header, while http_req_size covers the entire request. Raising the wrong one leaves the original constraint in place and increases resource consumption unnecessarily.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →HTTP/2 header-list limits
If VSL identifies an HTTP/2 header-list overflow, investigate h2_max_header_list_size rather than assuming the HTTP/1.1 request settings are responsible. HTTP/2 clients can compress headers on the wire, but the configured decoded header-list limit still governs acceptance.
Match the remedy to the failure
| Observed evidence | Likely emitting hop | First corrective action | Limit change, if justified |
|---|---|---|---|
HTTP/1.1 request has no valid Host |
Varnish | Fix the client or upstream proxy to send exactly one valid Host |
None |
BogoHeader with illegal syntax |
Varnish | Correct whitespace, control characters, names, or continuation lines | None unless a separate measured size limit is present |
| One Nginx header field exceeds one large buffer | Nginx | Remove unnecessary header data | Increase the Nginx buffer size at the narrowest scope |
| Varnish individual-header overflow | Varnish | Reduce the offending field | Increase http_req_hdr_len |
| Varnish total-request overflow | Varnish | Reduce cookies and forwarded headers | Increase http_req_size |
| Too many Varnish header lines | Varnish | Collapse duplicate or unnecessary headers | Increase http_max_hdr |
| PROXY framing mismatch | Listener receiving the wrong protocol | Make sender and receiver agree on PROXY presence and version | None |
Backend BogoHeader, FetchError, or response overflow |
Varnish while reading origin response | Inspect origin response headers and backend parsing | Investigate as a separate 503 issue |
Common scenarios and practical checks
A login request fails but anonymous traffic works
Compare the authenticated and anonymous request headers. Session systems often add cookies, and several stale or duplicated cookies can make one user’s request cross a per-field or total-size limit. Remove obsolete cookies at the application or client source before raising proxy limits.
Only requests passing through another proxy fail
Inspect the accumulated X-Forwarded-* and tracing headers. A chain that appends a new value at every hop can inflate both one field and the total request. Configure the upstream proxy to replace or bound the chain according to your trusted-proxy design.
Every request on one port returns 400
Check protocol framing before changing buffers. Confirm whether the port expects TLS, plain HTTP, or PROXY protocol, and verify the sender uses the same expectation. A systematic mismatch is unlikely to be solved by larger header buffers.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →HTTP/1.1 works but HTTP/2 fails
Compare the HTTP/2 header-list limit and the decoded header set with the HTTP/1.1 path. Investigate h2_max_header_list_size when VSL reports a header-list overflow, and keep the same data-cleanup approach for cookies and forwarded headers.
Safe change management and rollback
- Record the exact Nginx and Varnish versions, build options, listener topology, and current parameter values. Defaults and parameter names can vary by release, build, and Varnish edition.
- Capture the failing request before editing configuration so you can reproduce it after each change.
- Make one narrow change at a time. A simultaneous increase to every buffer makes attribution and rollback harder.
- Validate syntax before reload: use
nginx -tfor Nginx and the service’s supported Varnish configuration validation or startup path for Varnish. - Monitor memory and error logs after raising limits. Larger request workspaces allow larger allocations for every applicable transaction.
- Keep the prior configuration available and roll back if normal traffic becomes unstable, memory use rises unexpectedly, or the original request still fails.
Measure before you tune
Build a short evidence record for every failing transaction. Note the largest header field, total request-header bytes, request-line length, header-line count, protocol version, and the listener that accepted the connection. This lets you distinguish a single-field failure from an aggregate failure instead of guessing from a 400 alone.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Compare the same request at each hop without changing its method, path, authentication state, or headers. If the request succeeds when sent directly to Nginx but fails through Varnish, focus on Varnish parsing and limits. If it fails at both listeners, inspect the client-generated syntax or the Nginx buffer configuration. A minimal request that succeeds is useful only as a control; it does not prove the large request is valid.
Compare fixes by scope and risk
Request cleanup is the narrowest remedy: it removes stale cookies, duplicate names, malformed fields, or unbounded forwarding chains for all downstream components. A Nginx change can be limited to one server block, while a Varnish parameter normally affects the service instance and therefore a wider set of traffic. Prefer the smallest scope that covers the legitimate request.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsIncreasing a count does not increase a length. Raising http_max_hdr cannot make a long cookie fit, and raising http_req_hdr_len cannot permit more header lines. Likewise, adding more Nginx large buffers does not make one field longer. Larger limits consume more workspace memory and may permit more expensive requests, so record the old values and monitor resource use after the change.
Operational cost and version checks
This problem normally requires configuration work, log analysis, and a controlled reload rather than new hardware or a paid diagnostic product. The operational cost is engineering time to capture a reproducible request, validate syntax, coordinate the change, and watch memory afterward. Treat any proposed limit increase as a capacity decision, not a free fix.
Before editing, record the installed Nginx and Varnish releases, build options, service parameters, and listener topology. Directive defaults and available parameter names can vary by release, build, and Varnish edition. Vendor documentation gives the reference defaults, but your running service configuration is authoritative for the incident.
What a successful fix looks like
The final test should show more than a changed status code. The public request must reach the intended backend, the original request ID should appear in the expected logs, and VSL should no longer show the parser or limit event. Repeat a normal small request, the formerly failing request, and an intentionally malformed or incorrectly framed control request where safe. The control confirms that the proxy still rejects invalid traffic while accepting only the legitimate request you meant to support.
Frequently Asked Questions
How can I tell whether Nginx or Varnish generated the 400?
Correlate the timestamp and request ID with both logs, then query each listener directly with the same request. Varnish-side parser failures often show BogoHeader, LostHeader, or RespStatus 400 in varnishlog. If Varnish has no transaction or Nginx has no access entry, the request was rejected earlier in the path.
Which Nginx setting fixes a header that is too large?
An individual request-header field must fit inside one large_client_header_buffers buffer. Increase the buffer size, not just the number of buffers, and use the narrowest http or server scope. The documented default is four 8 KB buffers.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Should I increase http_max_hdr, http_req_hdr_len, or http_req_size in Varnish?
Match the parameter to the measured failure: http_max_hdr counts header lines, http_req_hdr_len limits one header’s length, and http_req_size limits the complete request. Increasing the wrong setting will not fix the original constraint and can consume additional memory.
Why does a missing Host header cause a Varnish 400?
Varnish’s built-in VCL returns 400 when it receives an HTTP/1.1 request without a valid Host header. Fix the client or upstream proxy so the request contains exactly one valid Host; changing buffer sizes is not a remedy.
Can a PROXY-protocol mismatch look like an Nginx header problem?
Yes. A listener expecting PROXY framing can reject ordinary HTTP, while a sender can send PROXY data to a listener that expects HTTP. Confirm that both peers agree on whether PROXY is enabled and on the protocol version before tuning header limits.
What should I do when only authenticated users receive 400?
Compare authenticated and anonymous headers. Large or duplicated session cookies, authorization values, and tracing headers can push one field or the total request over a limit. Remove obsolete data first, then raise a limit only if the remaining legitimate request is still too large.
Is a Varnish 503 caused by the same problem as this 400?
Usually not. A backend BogoHeader, FetchError, or response-header overflow indicates that Varnish had trouble parsing the origin response. Investigate that as a separate backend-response 503 path rather than changing client request limits.
Do I need to buy hardware or software to solve this error?
No. The remedy is normally request cleanup, log inspection, and a targeted configuration change. The meaningful trade-off is operational effort and the additional memory consumed if larger request workspaces are enabled.
The Bottom Line
Trace the 400 to the hop that emitted it, then classify the failure: malformed syntax, missing Host, protocol framing, one oversized field, total request size, or header count. Remove needless request data first. If legitimate traffic still requires more capacity, change only the implicated Nginx buffer or Varnish parameter, validate and reload safely, and confirm the complete path with logs. A backend response-header overflow is a separate Varnish 503 problem.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
