# Request Header Fields Too Large using Windows Login in Application Server

**URL:** <https://faq.inetsoftware.de/t/request-header-fields-too-large-using-windows-login-in-application-server/285>\
**Category:** General\
**Tags:** servlet\
**Created:** [May 22, 2024, 11:01am UTC](https://faq.inetsoftware.de/t/request-header-fields-too-large-using-windows-login-in-application-server/285 "2024-05-22T11:01:56Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![GerryWeissbach](https://faq.inetsoftware.de/user_avatar/faq.inetsoftware.de/gerryweissbach/32/90_2.png) [@GerryWeissbach](https://faq.inetsoftware.de/u/GerryWeissbach)\
**Post date:** [May 22, 2024, 11:01am UTC](https://faq.inetsoftware.de/t/request-header-fields-too-large-using-windows-login-in-application-server/285/1 "2024-05-22T11:01:56Z")

</div>

The Message “Request Header Fields Too Large” can appear in Application Servers when using Windows Authentication with our Applications.

**Prerequisites**

- Version 24.4 or newer
- Deployment of `*.war` or `*.ear` in application server, such as Tomcat

**Symptom**

- Users with large amount of group memberships receive a `Request Header Fields Too Large` with HTTP status code 431 or 400

**Reason**

- Since v24.4 the Windows Authentication plugin supports negotiation using Kerbereos tickets. These tickets can get large, depending on the group memberships. [See reference](https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-authentication-problems-if-user-belongs-to-groups)

**Solution**  
You do one of the following to resolve the issue:

1. _Temporary_: In the Login Settings of the applications Configuration Manager, change the `Negotiate + NTLM` setting to `NTLM`
2. _Recommended_: Change the maximum HTTP request header size in your Application Server (e.g. Tomcat) to, e.g. 64k. Details about how to do this can be found in your application server’s documentation.