Express: Large URI requests return a 400 Bad Request (should be 414)

[RMHonor]

Performing a GET request with a URI too long (as specified in https://github.com/nodejs/http-parser/blob/master/http_parser.h#L55) throws a 400 Bad Request error. This should be a 414 URI Too Long.

app.get('/test', (_, res) => res.sendStatus(200)

curl https://localhost:11000/test?q=query*8000 // 400 error

[dougwilson]

Hi, thanks for the report! Looks like it is the Node.js HTTP server itself that is doing this, so you'll likely have to file an issue at https://github.com/nodejs/node/issues . When it makes this 400, it doesn't even pass the request to Express.js at all, so Express does not have an opportunity to handle it.

Here is an example using the Node.js HTTP server:

$ node -e 'require("http").createServer((req, res) => console.log(req.url)).listen(4000)' &
[1] 7999
$ curl -i "http://localhost:4000/test?q=$(for i in `seq 1 8000`; do echo -n query; done)"
HTTP/1.1 400 Bad Request

[dougwilson]

For anyone who comes by, here is the link to the related Node.js issue: https://github.com/nodejs/node/issues/26296

[oshihirii]

hello, can anyone please help me understand why the examples above use strings of 8,000 bytes to exceed max limit, whereas the limit in the code referenced seems to be 80,000 bytes? i am trying to understand what the max limit is, i am on Node v10.16.0 and getting 400's with query string of 15,200 bytes. thank you.

[dougwilson]

This is a Node.js issue. You'll want to post your question in the linked issue above.