Error "400 Bad Request - Request Header Or Cookie Too Large" in ASP.NET MVC Application with AzureAD Authentication

Lydia 0

Hello,

We are experiencing an issue with our ASP.NET MVC application that involves multiple iframes. Each iframe embeds the same application, which may be hosted on different domains. Authentication within each iframe is performed using AzureAD.

When the iframes are loaded, some of them encounter the error "400 Bad Request - Request Header Or Cookie Too Large" during requests to the path "/signin-oidc". This issue appears to be related to the cookies .AspNetCore.OpenIdConnect.Nonce and .AspNetCore.Correlation.AzureADOpenID, which are sent multiple times in the request headers.

I have attached an image to demonstrate this behavior.

Could you please provide an explanation for why this issue occurs and suggest potential solutions to handle this situation?

Thank you for your assistance. AspNetCoreCookies

Chaithra E 480 Microsoft Vendor

Hello @Lydia,

Thanks for posting your question in the Microsoft Q&A forum.

This happens when the identity tokens gets too large. If the token contains too many claims, it might cause the cookie too large, and will show the 400 error.

To handle the 404 errors for /admin/host/ping in your ASP.NET MVC application hosted in Azure App Services, while reducing unnecessary logs in Application Insights, consider implementing the following solution:

Create a custom route for the /admin/host/ping endpoint:

routes.MapRoute( name: "AzurePing", url: "admin/host/ping", defaults: new { controller = "AzurePing", action = "Index" } );

Implement a controller to handle this route:

public class AzurePingController : Controller { public

Modify your Application Insights configuration to filter out these specific requests:

TelemetryConfiguration.Active.TelemetryProcessorChainBuilder
    .Use((next) => new FilteringTelemetryProcessor(next))
    .Build();

public class FilteringTelemetryProcessor : ITelemetryProcessor
{
    private ITelemetryProcessor Next { get; set; }

    public FilteringTelemetryProcessor(ITelemetryProcessor next)
    {
        this.Next = next;
    }

    public void Process(ITelemetry item)
    {
        if (!OkToSend(item)) { return; }

        this.Next.Process(item);
    }

    private bool OkToSend(ITelemetry item)
    {
        var request = item as RequestTelemetry;
        if (request != null && 
            request.Url.AbsolutePath.Equals("/admin/host/ping", StringComparison.OrdinalIgnoreCase))
        {
            return false;
        }
        return true;
    }
}

Thanks, Chaithra

Chaithra E 480 Reputation points Microsoft Vendor

2025-02-06T09:47:06.34+00:00

Hello @Lydia,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Thanks,
Chaithra E
Lydia 0 Reputation points

2025-02-06T16:04:20.02+00:00

Hello @Chaithra E ,

Thank you for your response. The code you provided above does not apply to our situation, as we are attempting to address a 400 error that occurs when the cookie size is too large with AzureAD. Could you please provide any other suggestions related to our situation?

1 answer

Bruce (SqlWork.com) 71,101 Reputation points

2025-02-04T16:09:11.36+00:00

This is typically caused by the user having too many role claims that makes the token too large to stored in a cookie. You are probably mapping all roles, you will need to refine the mapping.
Please sign in to rate this answer.
Lydia 0 Reputation points

2025-02-06T15:52:29.0666667+00:00

Hello Bruce, thank you for your response. We have already attempted to include only the necessary roles in the token, but we are still encountering the same error. Do you have any suggestions?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Error "400 Bad Request - Request Header Or Cookie Too Large" in ASP.NET MVC Application with AzureAD Authentication

1 answer

Your answer