Subject: status code for header fields to big

From: Julian Reschke <[email-masked]>
Date: Thu, 30 Jun 2011 14:46:37 +0200

Hi,

I quickly ran some tests, and the results are (with what I suppose are 
the default settings):

Apache-Coyote/1.1 (Tomcat):

Limit for a single header field: ~8000
Limit for all fields: ~8000
Status Code: 400

Apache/2.2.14:

Limit for a single header field: ~8180
Limit for all fields: > 16000
Status Code: 400

microsoft.com:

Limit for a single header field: ~16000
Limit for all fields: ~16000
Status Code: 400

google.com:

Limit for a single header field: ~15400
Limit for all fields: > 15400
Status Code: 400 (413 for the larger values)

So 413 doesn't seem to be used in general for this case.

Should it? In that case we should clarify the spec...

---

From: Willy Tarreau <[email-masked]>
Date: Thu, 30 Jun 2011 15:11:29 +0200

> Should it? In that case we should clarify the spec...

I think we should target 413 for this. Every time I got reports
of 400 due to too large requests, it wasted several persons' time
trying to figure what was wrong. Anyway if a UA doesn't know about
413, its interpretation falls back to 400 as for any unknown 4xx.

Just my 2 cents,
Willy

---

From: "Roy T. Fielding" <[email-masked]>
Date: Thu, 30 Jun 2011 10:17:59 -0700

> Should it? In that case we should clarify the spec...

We should define new 4xx codes for header block too long and
header field too long.

....Roy

---

From: Dzonatas Sol <[email-masked]>
Date: Thu, 30 Jun 2011 16:33:41 -0700

> We should define new 4xx codes for header block too long and
How many consider the length of the query string already given as the 
initial max length of the header lines; this could be an optimization to 
prefetch memory regions; the given length is the first read only 
well-known cookie from the client. Quadcores may just want the scalar 
value; four lines; 1k each, ascii. That's a lot of headers!

-- 
--- http://twitter.com/Dzonatas_Sol ---
Web Development, Software Engineering
Ag-Biotech, Virtual Reality, Consultant

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 1 Jul 2011 13:52:25 +1000

Personally - I think 413 is good for this; the response body and/or headers can fine-tune as to why it was rejected (as with any other error response).

Recall that we've already tuned the definition of 413 to say 

   The server is refusing to process a request because the request
   representation is larger than the server is willing or able to
   process.

note 'representation' -- which includes headers.

Cheers,

On 30/06/2011, at 10:46 PM, Julian Reschke wrote:

> Hi,
> 
> I quickly ran some tests, and the results are (with what I suppose are the default settings):
> 

--
Mark Nottingham   http://www.mnot.net/