4xx Client error · RFC 9110 §15.5.14

413 Content Too Large

The request body exceeds what the server is willing to accept.

What 413 means

Formerly "Payload Too Large" and still logged that way by many servers. A size limit somewhere in the chain rejected the upload: nginx (client_max_body_size, default 1 MB), Apache, a cloud load balancer, or the application's body parser.

Because the limit can be at any layer, the 413 page style tells you who sent it: a plain nginx page means the app never saw the request.

Common causes

  • File upload larger than the proxy limit.
  • JSON body over the framework limit (Express default 100 KB).
  • API gateway payload limits (for example 10 MB on some cloud gateways).

How to fix it

  • Raise client_max_body_size in nginx and the body-parser limit in the app, in that order.
  • For very large files, upload directly to object storage with a pre-signed URL.
  • Clients should not retry a 413 without changing the request.

What it looks like

A typical response:

HTTP/1.1 413 Content Too Large
Content-Type: text/html

<html><head><title>413 Request Entity Too Large</title></head>…

The same event in an nginx access log (the status is the number after the request line):

203.0.113.7 - - [10/Sep/2026:10:12:01 +0000] "POST /upload HTTP/1.1" 413 153 "-" "Mozilla/5.0"

Check it with curl

-i prints the status line and headers, and -w '%{http_code}' prints only the number, which is handy in scripts and health checks. Replace the URL with yours:

curl -i -X POST -H 'Content-Type: application/json' -d '{"a":1}' https://example.com/api/orders

Compare what curl sees with what the browser sees. A different status from the same URL usually means a cache, a CDN edge or a cookie is in the way.

Investigating a run of 413s? Paste the log excerpt into Log Share to get line numbers, highlighting and an expiring link for whoever is on call with you.

  • 400Bad Request: The server could not understand the request because it is malformed.
  • 414URI Too Long.
  • 507Insufficient Storage.

FAQ

I raised client_max_body_size and still get 413. Why?

Another layer has its own limit: the application server, a CDN, or a load balancer. Check the response page or Server header to see which component answered.