Uploaded image for project: 'Undertow'
  1. Undertow
  2. UNDERTOW-2392

Document that the MAX_HEADER_SIZE configuration includes the start/request line as well as the header block

XMLWordPrintable

    • Icon: Documentation Documentation
    • Resolution: Unresolved
    • Icon: Minor Minor
    • None
    • None
    • Documentation
    • None

      Hello,

         Based on our testing of the code, and an admittedly very light skim of the code here: https://github.com/undertow-io/undertow/blob/a41521a53c3b4ba71bd7e0a2d7040c2ff52ec376/core/src/main/java/io/undertow/server/protocol/http/HttpReadListener.java#L203

      It looks like the configuration MAX_HEADER_SIZE applies to the http start line (request line in requests) in addition the http header block.

      Since the current documentation states this specifically applies to the header block:

      The maximum size of a HTTP header block, in bytes. If a client sends more data that this as part of the request header then the connection will be closed. Defaults to 50k. 

      If someone is more familiar with the way the http spec defines things like "header block", "start line" and "request line" this can be confusing, particularly when dealing with middle boxes which do the same thing - e.g. envoy - and you're trying to track down what configs you need to tweak to allow longer URLs (which show up in the request line, not the header block)

      https://datatracker.ietf.org/doc/html/rfc9112#name-message-format

      Although I'd love to have two separate configs:

      MAX_HTTP_START_LINE_SIZE
      MAX_HTTP_HEADER_BLOCK_SIZE

      A documentation fix would address the challenges I encountered.

      But if you folks are open to two separate configs - let me know what / where / when to file!

              flaviarnn Flavia Rainone
              stu_s Stu S (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: