ERR_RESPONSE_HEADERS_TOO_BIG (Chrome Error 325)

What’s actually happening

The page fails in Chrome and Edge with ERR_RESPONSE_HEADERS_TOO_BIG, but the same URL often works in Firefox, which is more lenient about header size. curl -I shows a wall of headers — frequently a huge Set-Cookie or the same security header listed several times. This is about what the server sends back, not what the browser sends, which is what separates it from a 431 or the Nginx 400 above.

Common causes

• An enormous Set-Cookie — a session or auth cookie packed with serialized data, or many cookies set in one response.
• An oversized JWT or SSO token written into a header or cookie on login.
• Duplicated security headers, where both the app and the reverse proxy (Nginx/Cloudflare) add Content-Security-Policy, Permissions-Policy, etc., so each appears twice.
• A sprawling Content-Security-Policy or Permissions-Policy with hundreds of sources or directives.
• A misbehaving middleware that appends to a header on every pass instead of replacing it.

How to fix it

1. Dump the raw response headers and measure themRun 'curl -sD - -o /dev/null https://yoursite/path' or open DevTools > Network > the document request > Headers. Add up the response header bytes. The offender is almost always obvious — one giant Set-Cookie or a duplicated CSP.
2. Stop double-setting security headersDecide whether the app or the proxy owns headers like CSP, HSTS, and Permissions-Policy — not both. In Nginx use 'proxy_hide_header Content-Security-Policy;' before re-adding it, or strip them from the app. Two copies of a long CSP alone can blow the budget.
3. Shrink the cookie/JWTMove data out of the token and into a server-side session referenced by a short opaque ID. If you're serializing a user object or permission list into a cookie, that's the problem. Keep individual cookies to a few KB.
4. Trim the CSPCollapse duplicate sources, use a nonce or hash strategy instead of enumerating dozens of inline-script hosts, and drop directives you aren't enforcing. A tidy CSP is a few hundred bytes, not tens of KB.