Azure Portal: Bad Request - Request Too Long

问题:

I just received the following error when I tried to run a built-in b2c edit policy from portal.azure.com. I have 2 tabs of the portal open. Why am I receiving this error?

Bad Request - Request Too Long HTTP Error 400. The size of the request headers is too long.

Note: I experienced this same error message when testing active-directory-b2c-dotnet-webapp-and-webapi sample project. The reason provided was I was sending too many cookies. Is it the same problem?

If it is the same problem, shouldn't stale cookies be deleted before creating new ones?

---

I do see a lot of cookies for https://login.microsoftonline.com

回答1:

The error HTTP 400: Size of header request is too long generally happens because there's too many cookies or cookies that are too big.

Azure AD B2C's login goes through login.microsoftonline.com, as does almost every Microsoft service (O365, Azure, etc). So if you've got several accounts that you've signed in to across these services, you're accumulating cookies that will cause this problem.

This is bound to happen much more frequently to developers than end users as developers are logging in to the Azure portal with their corporate account, maybe also with a B2C admin account and then testing out their B2C-powered app with multiple logins.

In the long term, the answer will be to allow Azure AD B2C customers to specify their own custom domain. This gives the application's B2C cookies isolation from everything else in login.microsoftonline.com. As of 2017-09-16, this feature is still under development. You can support this feature and keep track of its progress by voting for it in the Azure AD B2C feedback forum: Customer-owned domains

However, in the interim, there are two things you can explore:

1. Clear your cookies. This will definitely work every time, it's just cumbersome, especially if presented to your end users.

2. Limit the amount of claims you include in your token. The more attributes you include in your policy, you'll end up with longer http requests which give you less margin for cookies from other Microsoft properties

Note: This is the same question as: http 400: size of header request is too long when signing in user using Multifactor authentication

回答2:

If you are encountering "HTTP Error 400 Bad Request - Request Too Long" for your azure account, you may also want to check whether the URL has been updated by microsoft.

In my case, I wanted to check on my Azure subscriptions. I used to go to this URL: https://account.azure.com/Subscriptions

But very recently it started giving me the "Bad Request Headers Too long" issue. I checked the URL and found out that it this is now the correct place to access my subscriptions: https://account.windowsazure.com/Subscriptions

回答3:

The issue is because of switching between multiple tenants and those creating cookies. We do facing this issue quite often. The only solution as of I know is deleting the cookies.

If you are a chrome lover there is an edit cookie extension, use that and try to delete the cookies of login.microsoftonline.com & portal.azure.com

回答4:

I think the problem is with the default OWIN implementation used in the sample MVC apps, the only thing you can do is close the browser (and all other instances) and restart.

You can watch the cookie get bigger and bigger and then eventually the browser gives up.

I have not tried the approach above about the plugin but will give it a go as its a bit smoother than killing all your browser windows

回答5:

You also may want to check b2clogin.com described here. As per Microsoft:

• Cookies are no longer shared with the other Microsoft services.

回答6:

I received multiple answers that this was because I was part of too many Active Directories. I was a part of ZERO active directories when I hit this issue. I cleared my cookies and got about two steps before this happened again. The request appears to be sending many, many microsoft cookies, azure cookies, facebook cookie, google cookies, adsense cookies, and linkedin cookies in the request, but deleting them all didn't help. I finally got through using an incognito tab.

tl;dr Try an incognito tab