Skip to content

Reduce the default size of max header sizes #11344

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maskit merged 1 commit into from
Jun 7, 2024
Merged

Reduce the default size of max header sizes #11344

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions doc/admin-guide/files/records.yaml.en.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1309,15 +1309,15 @@ allow-plain
in a request with the sum of their name and value that exceed this size will cause the
entire request to be treated as invalid and rejected by the proxy.

.. ts:cv:: CONFIG proxy.config.http.request_header_max_size INT 131072
.. ts:cv:: CONFIG proxy.config.http.request_header_max_size INT 32768
:overridable:
:reloadable:

Controls the maximum size, in bytes, of an HTTP header in requests. Headers
in a request which exceed this size will cause the entire request to be
treated as invalid and rejected by the proxy.

.. ts:cv:: CONFIG proxy.config.http.response_header_max_size INT 131072
.. ts:cv:: CONFIG proxy.config.http.response_header_max_size INT 32768
:overridable:
:reloadable:

Expand Down Expand Up @@ -4454,12 +4454,11 @@ HTTP/2 Configuration
Dynamic Table, however, headers still can be encoded as indexable
representations. The upper limit is 65536.

.. ts:cv:: CONFIG proxy.config.http2.max_header_list_size INT 131072
.. ts:cv:: CONFIG proxy.config.http2.max_header_list_size INT 32768
:reloadable:

This advisory setting informs a peer of the maximum size of header list
that the sender is prepared to accept blocks. The default value, which is
the unsigned int maximum value in |TS|, implies unlimited size.
Comment on lines -4461 to -4462
Copy link
Contributor

@bneradt bneradt May 13, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was this default statement simply incorrect?

Copy link
Member Author

@maskit maskit May 13, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, the sentence was not updated on #5319.

that the sender is prepared to accept.

.. ts:cv:: CONFIG proxy.config.http2.stream_priority_enabled INT 0
:reloadable:
Expand Down
6 changes: 3 additions & 3 deletions src/records/RecordsConfig.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -533,9 +533,9 @@ static const RecordElement RecordsConfig[] =
// ############
// # security #
// ############
{RECT_CONFIG, "proxy.config.http.request_header_max_size", RECD_INT, "131072", RECU_DYNAMIC, RR_NULL, RECC_NULL, nullptr, RECA_NULL}
{RECT_CONFIG, "proxy.config.http.request_header_max_size", RECD_INT, "32768", RECU_DYNAMIC, RR_NULL, RECC_NULL, nullptr, RECA_NULL}
,
{RECT_CONFIG, "proxy.config.http.response_header_max_size", RECD_INT, "131072", RECU_DYNAMIC, RR_NULL, RECC_NULL, nullptr, RECA_NULL}
{RECT_CONFIG, "proxy.config.http.response_header_max_size", RECD_INT, "32768", RECU_DYNAMIC, RR_NULL, RECC_NULL, nullptr, RECA_NULL}
,
{RECT_CONFIG, "proxy.config.http.push_method_enabled", RECD_INT, "0", RECU_DYNAMIC, RR_NULL, RECC_INT, "[0-1]", RECA_NULL}
,
Expand Down Expand Up @@ -1284,7 +1284,7 @@ static const RecordElement RecordsConfig[] =
,
{RECT_CONFIG, "proxy.config.http2.header_table_size", RECD_INT, "4096", RECU_DYNAMIC, RR_NULL, RECC_STR, "^[0-9]+$", RECA_NULL}
,
{RECT_CONFIG, "proxy.config.http2.max_header_list_size", RECD_INT, "131072", RECU_DYNAMIC, RR_NULL, RECC_STR, "^[0-9]+$", RECA_NULL}
{RECT_CONFIG, "proxy.config.http2.max_header_list_size", RECD_INT, "32768", RECU_DYNAMIC, RR_NULL, RECC_STR, "^[0-9]+$", RECA_NULL}
,
{RECT_CONFIG, "proxy.config.http2.accept_no_activity_timeout", RECD_INT, "120", RECU_DYNAMIC, RR_NULL, RECC_STR, "^[0-9]+$", RECA_NULL}
,
Expand Down