|
1 | 1 | --- |
2 | 2 | title: HTTP 400 error responses to HTTP requests |
3 | 3 | description: Works around an HTTP 400 error that the HTTP request header is too long. |
4 | | -ms.date: 05/14/2021 |
| 4 | +ms.date: 01/10/2025 |
5 | 5 | ms.custom: sap:WWW Authentication and Authorization\Windows Authentication |
6 | | -ms.reviewer: ivanpash |
| 6 | +ms.reviewer: ivanpash, paulboc |
7 | 7 | --- |
8 | 8 | # HTTP 400 Bad Request (Request Header too long) responses to HTTP requests |
9 | 9 |
|
@@ -35,7 +35,7 @@ Decrease the number of Active Directory groups that the user is a member of. |
35 | 35 | Increase the settings for the `MaxFieldLength` and the `MaxRequestBytes` registry entries on the server so that the user's request headers don't exceed these values. To determine the appropriate settings, use the following calculations: |
36 | 36 |
|
37 | 37 | 1. Calculate the size of the user's Kerberos token by using the formula described in the following article: |
38 | | -[Problems with Kerberos authentication when a user belongs to many groups](https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-authentication-problems-if-user-belongs-to-groups). |
| 38 | +[Problems with Kerberos authentication when a user belongs to many groups](../../../../windows-server/windows-security/kerberos-authentication-problems-if-user-belongs-to-groups.md). |
39 | 39 |
|
40 | 40 | 2. Set the value of `MaxFieldLength` and `MaxRequestBytes` on the server to 4/3 * T bytes, where T is the user's token size in bytes. HTTP encodes the Kerberos token by using base64 encoding. |
41 | 41 |
|
@@ -68,12 +68,12 @@ Set the key values as shown in the following table: |
68 | 68 | > [!IMPORTANT] |
69 | 69 | > Changing these registry keys should be considered to be extremely dangerous. These keys allow larger HTTP packets to be sent to IIS. This, in turn, may cause Http.sys to use more memory. Therefore, such changes can increase the computer's vulnerability to malicious attacks. |
70 | 70 |
|
71 | | -If `MaxFieldLength` is set to its maximum value of 64 KB, the `MaxTokenSize` registry value should be set to 3/4 * 64 = 48 KB. For more information about the `MaxTokenSize` setting, see [Problems with Kerberos authentication when a user belongs to many groups](https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-authentication-problems-if-user-belongs-to-groups). |
| 71 | +If `MaxFieldLength` is set to its maximum value of 64 KB, the `MaxTokenSize` registry value should be set to 3/4 * 64 = 48 KB. For more information about the `MaxTokenSize` setting, see [Problems with Kerberos authentication when a user belongs to many groups](../../../../windows-server/windows-security/kerberos-authentication-problems-if-user-belongs-to-groups.md). |
72 | 72 |
|
73 | 73 | ## References |
74 | 74 |
|
75 | | -- [Http.sys registry settings for IIS](https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/iisadmin-service-inetinfo/httpsys-registry-windows) |
| 75 | +- [Http.sys registry settings for IIS](../iisadmin-service-inetinfo/httpsys-registry-windows.md) |
76 | 76 |
|
77 | | -- [Error logging in HTTP API](https://learn.microsoft.com/en-us/windows/win32/http/error-logging-in-the-http-server-api) |
| 77 | +- [Error logging in HTTP API](/windows/win32/http/error-logging-in-the-http-server-api) |
78 | 78 |
|
79 | | -- [Problems with Kerberos authentication when a user belongs to many groups](https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-authentication-problems-if-user-belongs-to-groups) |
| 79 | +- [Problems with Kerberos authentication when a user belongs to many groups](../../../../windows-server/windows-security/kerberos-authentication-problems-if-user-belongs-to-groups.md) |
0 commit comments