-
Documentation
-
Resolution: Unresolved
-
Minor
-
None
-
None
-
None
Hello,
Based on our testing of the code, and an admittedly very light skim of the code here: https://github.com/undertow-io/undertow/blob/a41521a53c3b4ba71bd7e0a2d7040c2ff52ec376/core/src/main/java/io/undertow/server/protocol/http/HttpReadListener.java#L203
It looks like the configuration MAX_HEADER_SIZE applies to the http start line (request line in requests) in addition the http header block.
Since the current documentation states this specifically applies to the header block:
The maximum size of a HTTP header block, in bytes. If a client sends more data that this as part of the request header then the connection will be closed. Defaults to 50k.
If someone is more familiar with the way the http spec defines things like "header block", "start line" and "request line" this can be confusing, particularly when dealing with middle boxes which do the same thing - e.g. envoy - and you're trying to track down what configs you need to tweak to allow longer URLs (which show up in the request line, not the header block)
https://datatracker.ietf.org/doc/html/rfc9112#name-message-format
Although I'd love to have two separate configs:
MAX_HTTP_START_LINE_SIZE
MAX_HTTP_HEADER_BLOCK_SIZE
A documentation fix would address the challenges I encountered.
But if you folks are open to two separate configs - let me know what / where / when to file!