HTTP 400 response reported by external HTTP(S) load balancer

Problem

Requests made to external HTTP(S) load balancers are returning HTTP response code 400 (Bad Request) which are not visible in the backend Google Compute Engine VM instances or HTTP(S) load balancer logs.   

Environment

  • External HTTP(S) Load Balancer 

Solution

Inspect the request header field for client requests sent to the external HTTP(S) load balancer and ensure that they comply with RFC 7230. For example, the request below contains an invalid character '@':

> curl http://www.example.com -H "X-MyHeader-@: 123"

You will need to remove all invalid characters from the request headers to ensure compliance with RFC 7230. 

Cause

Custom HTTP headers must be a valid HTTP header field definition as per RFC 7230. The load balancer proxy (GFE) will reject requests which contain invalid headers with an HTTP response code 400 (Bad Request).

Below is a list of invalid characters which cannot be a part of a custom request header:

'\t', ' ', '(', ')', ',', '/', ';', '<', '=', '>', '?', '@', '[', '\\', ']', '{', '}', and DEL.