How to complete the challenge `GET /api/heartbeat (431) X-CHALLENGER too long`

By Alan RichardsonPublished 2026-07-20

Issue a GET request to /api/heartbeat with an X-CHALLENGER header longer than 100 characters.

To have the challenge tracked, start the header value with your real challenger GUID, then append extra characters.

Example:

X-CHALLENGER: your-real-guid-followed-by-extra-characters-to-exceed-the-limit

The response should be 431 Request Header Fields Too Large.

{
  "errorMessages": [
    "X-CHALLENGER header is too large, maximum allowed is 100 characters"
  ]
}

GET /api/heartbeat with an oversized X-CHALLENGER to trigger 431

Lessons Learned

431 Request Header Fields Too Large is a header-size failure, not an application payload error.
The X-CHALLENGER boundary shows that tracking headers need validation like user data.
Header-limit tests should change only header length so the cause stays obvious.

Increase the X-CHALLENGER value one chunk at a time to find the exact length boundary.
Compare oversized X-CHALLENGER with an oversized todo body to distinguish 431 Request Header Fields Too Large from 413 Content Too Large.

Experiment with this endpoint