AddLinkHeadersForPreloadedAssets causes issues when there are too many files

[mikethea1]

Laravel Version

10.32.1

PHP Version

8.2.7

Database Driver & Version

AWS MySQL RDS

Description

After struggling for a while to debug a very difficult issue, I've traced it down to the AddLinkHeadersForPreloadedAssets middleware generating a header which > 8190 characters and then getting rejected by apache.

Given how difficult this is to track down (it is even dependent on your domain name so a site can work fine when hosted under one domain and then the same code fails when hosted on a longer domain) and that as I understand it this is purely an optimization, I think this middleware should be changed so that it constrains the max size of the generated header to ~8000 characters (limit could be configurable). That means fewer things get preloaded, but better than the site not working at all.

This seems to be another example of someone hitting this.

Steps To Reproduce

The link header lists all the vite preload assets; you just need to make an Inertia::render() page where the set of vite preload assets gets long enough to push this beyond what your server allows.

[driesvints]

Thanks @mikethea1.

@timacdonald do you know if we can limit the size of the generated header here?

[mikethea1]

@driesvints I've been having success replacing the default middleware with this version:

/**
 * Workaround for https://github.com/laravel/framework/issues/49214; this keeps the preload header from getting too large.
 * 
 * This file is a stand-in replacement for \Illuminate\Http\Middleware\AddLinkHeadersForPreloadedAssets
 * 
 * See also https://stackoverflow.com/q/77586580/1142970
 */
class AddLinkHeadersForPreloadedAssets
{
    /**
     * https://stackoverflow.com/questions/24273399/how-to-change-the-limitrequestfieldsize-in-apache-2-4-2#comment126988931_24287119 and other
     * internet sources suggest the max is 8K. My empirical testing suggests its 8183 at least for Link. Choosing 8150 for safety.
     */
    private const APACHE_MAX_HEADER_SIZE = 8150;

    public function handle($request, $next)
    {
        return tap($next($request), function ($response) {
            $preloadedAssets = Vite::preloadedAssets();
            if (empty($preloadedAssets)) { return; }

            $linkHeaderValue = '';
            $linkHeaderLength = 0;
            foreach ($preloadedAssets as $url => $attributes)
            {
                $linkHeaderSegment = (empty($linkHeaderValue) ? '' : ', ')."<{$url}>; ".implode('; ', $attributes);
                $linkHeaderLength += strlen($linkHeaderSegment);
                if ($linkHeaderLength > self::APACHE_MAX_HEADER_SIZE) { break; }
                $linkHeaderValue .= $linkHeaderSegment;
            }
            $response->header('Link', $linkHeaderValue);
        });
    }
}

Basically we append to the header incrementally, stopping when it would overflow. I'm working off the assumption (which I believe is correct) that the Link header is purely an optimization, and therefore we can maximize the performance benefit by including as many assets as possible.

[timacdonald]

I don't think there is a generic way for us to handle this. The middleware isn't applied by default, so it is opt in.

I would recommend crafting your own version that limits the output header size.

[mikethea1]

I don't think there is a generic way for us to handle this

@timacdonald isn't the approach I posted a generic way to handle this? Maybe we can't generically detect the max header length for the web server, but going with a reasonable default and providing configurability seems preferable over the current behavior.

[papppeter]

thanks for the solution! saved my time!

[mikethea1]

@timacdonald any chance you're willing to reconsider incorporating the length cap by default (with a config option to raise)?

[timacdonald]

I've opened a PR to allow you to limit the number of assets that will be preloaded: #55618