Okta "400 Bad Request" Error Occurs When Logging Into an Application Using Internet Explorer

Okta generates a 400 Bad Request error when a user logs into an application using Secure Assertion Markup Language (SAML) authentication via Internet Explorer. This issue occurs because the SAML request URL exceeds the character limit of the browser. Resolve the error by using a different browser or reducing the SAML request size.

400 bad request

Other browsers, such as Chrome, Safari, and Firefox, do not encounter this error.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Secure Assertion Markup Language (SAML)
• Internet Explorer (IE)
• Custom Browsers With an Embedded IE Browser

Internet Explorer limits the number of characters allowed in the SAML request URL to a maximum of 2,083 characters. This limit applies to both POST requests and GET requests URLs. Support for Internet Explorer ended on June 15, 2022, and Microsoft permanently disabled Internet Explorer 11 through a Microsoft Edge update on certain versions of Windows 10.

How is the 400 Bad Request error resolved?

Bypass the browser character limit by switching to a modern browser or reducing the size of the SAML request.

• Use a different browser, such as Chrome, Safari, or Firefox. If a visited site requires Internet Explorer 11, reload the site using Internet Explorer mode in Microsoft Edge.
• Reduce the size of the SAML request so the URL falls below the 2,083 character limit by removing unnecessary or unused values and attributes.

The GET and POST Methods Have Different Character Limits

The GET method limits the URL to a maximum of 2,048 characters minus the number of characters in the actual path. The POST method does not limit the URL size for submitting name and value pairs, as the browser transfers these pairs in the header instead of the URL.