Intermittent 431 Request Header Fields Too Large on Okta Authn POST /api/v1/authn/factors/password/verify Environment

[yashvanth-circle-k]

Describe the bug?

We intermittently receive HTTP 431 (“Request Header Fields Too Large”) during sign-in when calling: POST https://{okta-domain}/api/v1/authn/factors/password/verify
This endpoint is invoked as part of an Okta Authn v1 transaction where the app first obtains a stateToken from Okta, then submits the user password along with that stateToken to /authn/factors/password/verify. The failing request body looks like: {"stateToken":"...","password":"..."}
This has been observed in a flow where a user previously signed in, logged out, and then attempts to sign in again.
We also observed it on a device that had multiple variants of our app installed (different environments/regions). After deleting all variants and reinstalling a single one, the issue was no longer observed on that device.
Expected behavior /api/v1/authn/factors/password/verify should return a normal Okta Authn response (success or standard 4xx for invalid credentials), not 431.
Actual behavior The request returns 431 and an HTML response body. Example response body:
{ "data": "\n\n431 Request Header Fields Too Large\n\n
Request Header Fields Too Large
\n
The server refused this request because\nthe request header fields are too large.
\n\n" }

What we do on logout We clear our app state/storage and call the SDK token clear (clearTokens()).

What is expected to happen?

When calling the Okta Authn endpoint
POST /api/v1/authn/factors/password/verify with a valid stateToken and user password:

• The request should be processed normally by Okta’s Authentication API.
• The response should be a standard JSON Authn response, such as:
• 200 OK → authentication success (e.g., status: SUCCESS with sessionToken)
• 200 OK (MFA_REQUIRED / MFA_CHALLENGE) → if additional verification is needed
• 4xx errors (like 401 / 403) → for invalid credentials, expired stateToken, etc.

What is the actual behavior?

• The request intermittently fails with HTTP 431 (Request Header Fields Too Large)
• The response is HTML instead of a JSON Authn response
• The API does not return expected authentication responses (success or standard 4xx errors)
• The failure appears inconsistent and environment/device dependent

Reproduction Steps?

Reproduction Steps

1. Install multiple variants of the app (e.g., different environments/regions) on the same device.
2. Launch the app and initiate the sign-in flow.
3. Call /api/v1/authn to obtain a stateToken.
4. Submit credentials using:
5. POST /api/v1/authn/factors/password/verify with stateToken and password.
6. Verify that login is successful.
7. Log out of the application:
8. Clear app state/storage
9. Call clearTokens()
10. Relaunch the app and attempt to sign in again.
11. Repeat the login/logout cycle a few times.

Observed Result

• Intermittently, the request to /api/v1/authn/factors/password/verify fails with HTTP 431 (Request Header Fields Too Large) instead of returning a normal authentication response.

Additional Information?

No response

SDK Version

SDK: @okta/okta-react-native 2.17.1
App: React Native v0.78.2
API: Okta Authentication API v1 (/api/v1/authn/...)

Build Information

No response