Node: Make HTTP_MAX_HEADER_SIZE configurable

[elmarx]

Is your feature request related to a problem? Please describe.

The recent limitation to HTTP_MAX_HEADER_SIZE (186035243f) to mitigate CVE-2018-12121 is a problem for us.

We use headers internally to communicate the users' session, and sometimes (legitimate) requests from "outside" exceeed the 8 kb limit, too.
Given that JWT-strings easily exceed 1kb, I think the 8kb limit might be too little for others, too.
Or referrer-headers (especially in combination with payment-systems back-and-forth) tend to exceed 1kb, too.

Describe the solution you'd like
Have the possibility to configure the HTTP_MAX_HEADER_SIZE — at least via configuration-flag (at node-compile-time).
Setting this at run-time or at startup time would be nice, too.

Is setting this at compile time already possible? I couldn't find the option or best way to do it for node-gyp/gyp.

Describe alternatives you've considered

_patching nodejs at compile time_… not a good idea.

_Reduce headers_, yeah, would be nice, but that means completely changing parts of our architecture.

[mcjfunk]

Major +1 here. Our large enterprise is not in the position to reduce the possible headers that flow through our infrastructure to 8k. Agree that patching node at compile time is not a good solution for us.

[mpaw]

We are running into the same issue. The drop from 80kb to 8kb is forcing us to stick with the previous version of node until this is resolved.

This needs to be configurable either through a command line option, environment variable, or in code. A compile time flag is not a good solution for us (or probably 99% of other devs) either.

[cjihrig]

Sorry if I missed the conversation somewhere, but do we have the option of updating http_parser (or floating a patch on it) to make the max header size configurable at the parser level?

I did a little experimenting (definitely not PR ready at this point) at https://github.com/cjihrig/node-1/commit/e55765dc9f32407dc70d365a9de21341c6ac6adb, and was able to adjust the max header size. It breaks ABI, but I'm not sure if we worry about that with the http parser.

cc: @bnoordhuis

EDIT: I don't think I would attach the max header size to the parser, but maybe add a function that sets the global max header size. That shouldn't break ABI. (https://github.com/cjihrig/node-1/commit/fb615c531ef4ba7c2c15d6ef9690f05df7c516e5)

[foo4u]

It's also a major issue that this went out as a patch level fix to LTS editions. This is a breaking change.

Ideally this 8K hard limit commit should be reverted and new LTS releases cut.

[brycesteinhoff]

This affects us also, as our headers are right around 8k usually, but sometimes more (we have JWT tokens which account for > half of this).

Our base Docker images were locked to a Node major version, so this breaking change appeared out of nowhere when the upstream image updated the Node minor version.

[bnoordhuis]

It breaks ABI, but I'm not sure if we worry about that with the http parser.

http-parser does, as do distros that link node to http-parser dynamically.

A possible way forward: split p->nread into two, p->nread and p->nread_max, possibly with better names. :-)

Drawback: there are some downstream projects that read p->nread, even though it's marked as private.

[cjihrig]

@bnoordhuis what about a function that would allow setting the global max header size? It's not necessarily the most elegant solution ever, but I don't think it would break anything.

[bnoordhuis]

That could work. Two issues with the patch:

• Don't use a k prefix if it's not actually constant.
• Set the limit once, not every time a new parser is instantiated.

[elad-yosifon]

A week of debugging finally brought me here....
could of been easily solved if there was a simple debug log line that indicates that the request was blocked

[siboulet]

The biggest problem with this 8KB header limit change in my opinion is that it also applies to outbound HTTP requests response header parsing. Without any sort of runtime maximum HTTP header size parameter that can be defined in http request, Node.js will start throwing HPE_HEADER_OVERFLOW exceptions when parsing responses from external HTTP API calls that have large response headers (which isn't so uncommon when you factor in JWT and CSP headers).

[Fishrock123]

@mcollina Have you seen the above comment?

[mcollina]

Thanks @Fishrock123 for the ping! I didn't see the message.

The biggest problem with this 8KB header limit change in my opinion is that it also applies to outbound HTTP requests response header parsing. Without any sort of runtime maximum HTTP header size parameter that can be defined in http request, Node.js will start throwing HPE_HEADER_OVERFLOW exceptions when parsing responses from external HTTP API calls that have large response headers (which isn't so uncommon when you factor in JWT and CSP headers)

From a technical perspective, I think we could make this setting per-instance of the http parser once we switch to llhttp. I think should be our target.
Note that https://github.com/nodejs/node/pull/24811 is going to make this configurable with a startup option, which is a step in the right direction.

@siboulet Regarding the default limit, I'm open to increase it to 10KB or 12KB if it's common to have more than 8KB of headers data. Our assumption was that 8KB was plenty. Would you mind opening a new issue about changing the default value, and making some examples of requests that will trigger this?

[1I1III1liL1]

could of been easily solved if there was a simple debug log line that indicates that the request was blocked

I think this is one of the biggest issues with introducing a breaking change without updating the major version. What was working suddenly isn't, and I've yet to see any log files that showed me why the request was being rejected. Sending a 400 with no details and no server-side log doesn't feel like the right way to go about it. Maybe I'm missing where that log would be generated?

[yonjah]

From a technical perspective, I think we could make this setting per-instance of the http parser once we switch to llhttp. I think should be our target.

@mcollina is this still a target ? is there any issue tracking it ?
Couldn't find any open issues for it.

Thanks

[mcollina]

This was solved in https://github.com/cjihrig/http-parser/commit/0ae8d93f7335c0279f37b5ca5c26ea881ac17586. Is there anything that is not clear?

[yonjah]

Sorry maybe I misunderstood your comment.

I thought it references an option to set it per instance of the http server. like-
http.createServer({maxHeaderSize: 8000}, (req, res) => {...})

So if I have two servers running in the same process I can have for example an internal one that has higher limit than the public facing one.

It's not a major issue, but I was mostly hoping I can enforce the size limit from code so I wont have to rely on some external variable which feels less reliable

[mcollina]

Is this enough
https://nodejs.org/api/http.html#http_http_maxheadersize? It’s per-process
but you can configure it via code.

Il giorno mar 12 mar 2019 alle 08:54 Yoni Jah [e-mail] ha
scritto:

Sorry maybe I misunderstood your comment.

I thought it references an option to set it per instance of the http
server. like-
http.createServer({maxHeaderSize: 8000}, (req, res) => {...})

So if I have two servers running in the same process I can have for
example an internal one that has higher limit than the public facing one.

It's not a major issue, but I was mostly hoping I can enforce the size
limit from code so I wont have to rely on some external variable which
feels less reliable

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/nodejs/node/issues/24692#issuecomment-471891619, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AADL4y9W74zqvxn9ytXx8TSsdLm7eGG1ks5vV102gaJpZM4Y3Vag
.

[yonjah]

Isn't it read only ? so I can see if it was set to a different value but I can't change it.

I don't mind an option to change it per process but I don't want to rely on the cli to set it

[tony-gutierrez]

We definitely need a way to configure this in code, for use on cloud hosts. Configuring via cli flag is not always possible.

[tony-gutierrez]

Even better a rever for LTS versions.

[MylesBorins]

@tony-gutierrez you can set any of the command-line options via an environment variable NODE_OPTIONS is that sufficient? As this change came as a security fix we will not be reverting the change

[yonjah]

@MylesBorins at least in my use case there is no real than setting it via NODE_OPTIONS
especially since it will fail to run node if the option does not exist.
So running the app requires different command line/env variable depending on the node version it runs
Which can be a bit of a pain (not major).

Not sure about the internals but is there any technical limitation that this can't be set per HTTP server instance ?

[MylesBorins]

@yonjah this was backporting all the way back to 6.x... if the flag doesn't exist the version of node most likely does not have the patch to change header size.

Regarding the change itself... the header size is set in the C++ http parser... this is not something that can be changed on a per request basis and is something that needs to be set a single time for the runtime at startup. The variable that can be accessed on http.maxHeaderSize is sharing the value that has been set, but by the time it is accessed the C++ code has already been run and cannot be changed

[oshihirii]

can anyone please tell me what header and query string limits are in node version v10.16.0?

i am getting 400 errors on requests with long query strings (eg ~15200 bytes) and wondering if it could be caused by some sort of "max limit".

thank you.

[rosswilson]

@oshihirii The limit for 10.16.0 is 8kb: https://github.com/nodejs/node/blob/v10.16.0/src/node_options.h#L119

[oshihirii]

thank you very much @rosswilson.

just to clarify - are query strings included in the 8kb header limit?

also, wondering why:

https://nodejs.org/api/http.html#http_http_maxheadersize

states:

http.maxHeaderSize was added in: v11.6.0

whereas the 10.15.0 changelog lists the addition of the maxHeaderSize property as a notable change.

just curious to know when the 80kb limit was decreased to 8kb.

thanks again.

[rosswilson]

@oshihirii I'm not sure, perhaps someone else here can help you with those questions.

[elmarx]

According to my research (i.e. looking at the code) when opening the issue, the request-path (and thus the query-string) does count as header for nodejs, although the RFC for HTTP states otherwise (i.e. path is not a header).
IIRC the Initial Header limit has been introduced with node 10.14.1.

[oshihirii]

thanks very much @zauberpony.

interesting, when i console.log(req.headers) it doesn't show the query string, but perhaps req.headers does not actually contain all the information included in the header. i tried logging req.header, but that seems to be a function and therefore not loggable :).

[srinath-ragh]

@oshihirii It does seem like query params are considered headers. Tried a long list of query params (about 10kb) on v10.12.0 vs v10.16.0 and 10.12 responds with a 200 while 10.16 gives a 400.

[lynnic26]

@oshihirii It does seem like query params are considered headers. Tried a long list of query params (about 10kb) on v10.12.0 vs v10.16.0 and 10.12 responds with a 200 while 10.16 gives a 400.

It is because this change(big header limit) was applied in 10.14.0, so versions (within 10) small than 10.14.0 will return 200。

[lynnic26]

I tried numbers of node version

• 8.14.0 no return
• 10.14.0 return 400
• 10.12.0 return 200
• 11.3.0 return 400
• 12.14.0 return 200
• 13.6.0 return 200
  I'm confused why version 12 and 13 will return a 200 status?
  One point, header limit feature was added in Noverber 10 2018 when 12 and 13 was not released at all.
  Could someone clarify it?

[cekvenich]

I'm getting these errors with long query strings!
As per spec, querystring can be unlimited in size.
ps, using the latest express both with node 13.8 and node 12.16.
Any suggestions?

[gentlefox]

I'm getting these errors with long query strings!
As per spec, querystring can be unlimited in size.
ps, using the latest express both with node 13.8 and node 12.16.
Any suggestions?

I suggest scrolling up and reading this very informative thread.
querystring may be unlimited in size, but for use within node it combined with url (protocol+hostname+path) combined with headers can have a default max size of 8kB (It appears that the ticket to have this increased to 16kB is still open since May last year).

To find out during runtime what your node instance is set to: http.maxHeaderSize.
To config node to have a different value, the flag is --max-http-header-size.

EDIT:
It appears you can add maxHeaderSize property to the RequestOptions to override this value. Value in bytes. Dafault: 8192.

[cekvenich]

@gentlefox Where do you set Request options?
I'm looking here: http://expressjs.com/en/4x/api.html#req

Is there an example?

(for sure this needs to be programmatic and not a CLI)

[gentlefox]

Within your services.
Express "request" and "response" are essentially Node's http(s).request() and http(s).response().
Read the Nodejs documentation:(https://nodejs.org/api/http.html#http_http_request_options_callback) and also the https equivalent, which simply adds these tls.connect() options to the available http.request options: ca, cert, ciphers, clientCertEngine, crl, dhparam, ecdhCurve, honorCipherOrder, key, passphrase, pfx, rejectUnauthorized, secureOptions, secureProtocol, servername, sessionIdContext.

If unsure, compare with the Express.js code:
latest: https://github.com/expressjs/express/blob/master/lib/request.js
v4: https://github.com/expressjs/express/blob/4.x/lib/request.js

You'll see Express.js as a convenience utility that simplifies using native Node.js.