Issue 56 - Add limit to size of headers - #232
Conversation
Tests HTTP headers for byte limit. Complete field may be 2048 Bytes and the complete header may be 8192 Bytes big. These are limitations similar used by popular HTTP servers.
Each header field is limited to max. 2048 Bytes. The complete header is limited to max. 8192 Bytes. Returns HTTP Status 431 Request Header Fields Too Large when the header is over size. Closes tiny-http#56 The read and parse of `ClientConnection` uses stringent `AsciiStr`. No need for `String` or `&str` during reading.
Return HTTP status "414 URI Too Long" if request line is over 2048 bytes.
|
IMHO 8192 bytes in total is much too small. If the browser is configured to send the full URL in the Apaches defaults are:
|
|
I have to agree with @Kijewski here, I've seen no end of questionably designed applications that include kilobytes of payload in either query parameters or really long path-style URLs (cough WebSphere). Using Apache's default values here works for me, but we do need to consider this a breaking change and gate it behind a |
|
@Kijewski @bradfier Don't you develop the "questionable" application with tiny-http itself and therefor why you want to develop a bad kind of WebSphere JEE app with tiny-http where you possible have base urls with thousands of characters and same for cookies? |
Hello,
I think it is required to not handle http headers and header fields of any size the clients might provide. (DOS, OOM)
This PR limits the header body to 8192 bytes and the header lines to 2048 bytes. Popular servers (apache, nginx) have similar restrictions.
When a client is going over the limits the HTTP status 431 Request Header Fields Too Large is returned.
I've seen that it has been already the intention in #56 to implement this.
I hope this PR is welcome.