Home / server / Questions / 478392
Accepted
fuero
Asked: 2013-02-14 06:50:56 +0800 CST

HTTP Request Header limit hard coded in Apache 2.2

  • 772

I looked up some other question concerning this on SF, they revolved around a maximum limit being set for LimitRequestFieldSize and LimitRequestLine at 8K.

httpd's documentation confirms the limit, but doesn't list the value to be fixed.

I tried increasing it, which didn't work. Decreasing didn't work either. Every source I turned up just indicated that there's a maximum limit.

To check how long a header may be, I issued this command:

curl -v -H "CustomHeader: `printf '1%.0s' {1..n}`" hostname

I installed apache2 on a RHEL 6.3 VM and tried various values for both directives (specified in /etc/httpd/conf/httpd.conf).

For reference, apache2's version:

Name        : httpd
Arch        : x86_64
Version     : 2.2.15
Release     : 15.el6_2.1

Now here's the question:

I get that I can't increase it past 8K (seems the Redhat people didn't touch the limit), but why can't I decrease it? Whatever value I specify, apache will return errors if n is greater than 8K.

apache-2.2

1 Answers

  1. Best Answer

    There's a warning in the docs.

    Warning
    When name-based virtual hosting is used, the value for this directive is taken from the default (first-listed) virtual host for the NameVirtualHost the connection was mapped to.

    It's not clear from this setence if any value in httpd.conf will be ignored if you are using name-based virtual hosting. Are you using name-based virtual hosts and have you tried putting this directive in the first one?

    • 1