JAVA -tomcat- Request header is too large

Question

INFO: Error parsing HTTP request header
 Note: further occurrences of HTTP header parsing errors will be logged at DEBUG level.
java.lang.IllegalArgumentException: Request header is too large
    at org.apache.coyote.http11.InternalInputBuffer.fill(InternalInputBuffer.java:512)
    at org.apache.coyote.http11.InternalInputBuffer.fill(InternalInputBuffer.java:501)
    at org.apache.coyote.http11.InternalInputBuffer.parseRequestLine(InternalInputBuffer.java:171)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:996)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:623)
    at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:318)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:722

How could I solve this in my spring web application?

I had gone through this thread Request header is too large

Did you capture the http packets for this request and tried to view the headers? — Himanshu Bhardwaj, Sep 27 '16 at 09:07
i think there should be some configuration changes in tomcat irrespective of eclipse @GhostCat — Sarthak Srivastava, Sep 27 '16 at 09:07
I need to know what configuration changes and where i need to make in my spring app or tomcat? @Himanshu — Sarthak Srivastava, Sep 27 '16 at 09:08

Jay Ehsaniara · Answer 1 · 2018-02-26T19:31:01.537

48

here is the question, is there any limit in HTTP headers? The Answer is No. there is no limit but web-servers are limiting their incoming request header size even in POST requests therefore we getting 413 (Request header is too large). This limitation is including request line and header fields.

http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize

https://tomcat.apache.org/tomcat-5.5-doc/config/http.html

http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers

Maximum on http header values?

In my case, I had SpringBoot 1.5.8 and used HTTP POST, however I had to add:

server.max-http-header-size=10000000

in application.properties.

edited Feb 26 '18 at 19:31

answered Dec 01 '17 at 10:30

Jay Ehsaniara

1,421
17
24

I added MB to the size value 10000000 to get 10000000MB. because it gives the following error Failed to bind properties under 'server.max-http-header-size' to org.springframework.util.unit.DataSize: – mumbasa Feb 27 '20 at 16:39
12

10000000MB is almost 10TB, are you planning to send 10TB in the header? – Jay Ehsaniara Feb 27 '20 at 19:16
1

I was only pointing out i had to add MB to the value for it to work for me i used 1MB – mumbasa Feb 28 '20 at 13:35
I had to use server.tomcat.max-http-header-size instead – TomTasche Oct 21 '20 at 11:46
Just as an FYI, I am pretty sure SpringBoot properties like `server.max-http-header-size` and 'server.tomcat.max-http-header-size' will only work if you are running an embedded server. – matt forsythe Aug 16 '23 at 20:12

score 33 · Answer 2 · answered Apr 06 '19 at 04:55

The maximum size of the request and response HTTP header, specified in bytes. If not specified, this attribute is set to 4096 (4 KB).

To avoid getting Error parsing HTTP request header error you can increase the following value by doing this.

Go to following location: $TOMCAT_HOME/conf/server.xml

In server.xml change the HTTP/1.1 Connector entry and set the maxHttpHeaderSize to "65536" (64Kb in bytes) as shown below:

<Connector port="8080" maxHttpHeaderSize="65536" protocol="HTTP/1.1" ... />

Or

You can use the POST method it can carry upto 2 megabytes according to Tomcat.

The maximum size in bytes of the POST which will be handled by the container FORM URL parameter parsing. The limit can be disabled by setting this attribute to a value less than or equal to 0. If not specified, this attribute is set to 2097152 (2 megabytes).

Hope this information would help you..

Sarthak Srivastava · Accepted Answer · 2018-06-29T04:36:40.600

28

Solved! I was using HTTP GET instead of HTTP POST. Technically I have seen HttpGet will have issue if the URL length goes beyond 2000 characters. In that case, it's better to use HttpPost or split the URL. Browsers have limits ranging on the 2kb - 8kb

Tomcat: Request header Too large

edited Jun 29 '18 at 04:36

answered Sep 27 '16 at 09:27

Sarthak Srivastava

1,490
3
15
33

score 13 · Answer 4 · answered Feb 04 '21 at 17:11

13

With Spring Boot 2.4 in application.properties:

server.max-http-header-size=10MB

answered Feb 04 '21 at 17:11

Markus Pscheidt

6,853
5
55
76

score 8 · Answer 5 · answered Apr 12 '17 at 10:30

8

It's not about POST or GET but rather what is the header size limit setup for the Tomcat used by your application.

You can always control and configure that using app properties as below: server.tomcat.max-http-header-size=1024

Where 1024 is in Bytes.

answered Apr 12 '17 at 10:30

Ashwin Gupta

920
1
11
17

Many answers, here, seem to confuse headers and query string/request body. – Christopher Schultz Jun 07 '21 at 19:35
2

For Springboot 2.x `server.max-http-header-size=1KB` – Ele Aug 04 '21 at 10:29

score 6 · Answer 6 · answered Jul 26 '17 at 10:03

I know it is an old post. However I think it is good to clarify some bits.

Using _server.tomcat.max-http-header-size=max_wanted_size_ parameter you will change the server to accept up to max_wanted_size, but even if you set that to 10Mb the browser will cut your request param to the browser limit size. I have tried in chrome and it seems to be around 150-200kb.
The java.lang.IllegalArgumentException is happening in the server and it hasn't any to do with the browser. Hence, changing server.tomcat.max-http-header-size should be good enough and it is happening when using GET method but it can also happen when using POST method (In the POST case maxPostSize parameter should be changed).

score 3 · Answer 7 · answered May 18 '20 at 02:21

I'll add a different "answer" to this problem: the problem could be too many or too large cookies, in the browser of the user visiting the site giving the error.

While most have (understandably) focused on how to change Tomcat to ALLOW a larger header, I'll point out that in a case where I experienced this error, I was able to use my browser dev tools to see that somehow there was a very large number of cookies being sent to the site which generated the error. (They seemed of a sort that I felt something on the server had been mistaken in creating so many, as they had named that were near duplicates of each other, with dupe values.)

I cleared the cookies for this site (using the browser dev tools), and now I did not get the error. Of course, clearing cookies can cause issues like being logged out of the site, etc. In my case, that was a small price to pay for being able to use the site again.

I leave this in case others may hit it some day, and either be the person getting the error (like I was) or a server admin whose users are reporting it, who could ask them to consider clearing the cookies for their site (there are many ways, of course, and web sites to help).

Thanks a lot for leaving this up. Had exactly same problem with my GeoServer instance. — Napuu, Apr 21 '22 at 09:07

score 1 · Answer 8 · answered Sep 14 '21 at 08:17

1

I got the same error while using a Spring Boot app. I just changed data sending way to using Postman form-data from query param and the problem has been solved.

answered Sep 14 '21 at 08:17

menoktaokan

346
3
13

score 0 · Answer 9 · answered Apr 07 '20 at 23:19

0

Its an old post - but anyone looking to change server.max-http-header-size in latest spring boot (version >=2.1) - Value should be provided in Datasize parsable value e.g - server.max-http-header-size=64KB

answered Apr 07 '20 at 23:19

Poovarasan Manickam

1
3

score 0 · Answer 10 · answered Jul 18 '20 at 12:09

In my case, i was displaying a blob image as a url path <img src="example.com/{extremely-long-base64-encoded-string}"> instead of <img scr="data:;base64,{extremely-long-base64-encoded-string}">

You notice the difference, that's what caused the error INFO: Error parsing HTTP request header java.lang.IllegalArgumentException: Request header is too large

score 0 · Answer 11 · answered Dec 29 '21 at 16:02

I just experienced this problem while trying to debug a web app running con localhost tomcat for NetBeans IDE.

Before I could find any solution, tried from Firefox and did not presented the issue.

Turned out Chrome was sending some cookie value or values and hitting some configured limit.

Just erased cookies for localhost from Chrome's developer tools and problem solved.

score 0 · Answer 12 · answered Jan 07 '22 at 09:41

In my case, I had a spring boot app that used to redirect to another jetty app based on the request URL. I had to modify it in both places.

Spring Boot

server.max-http-header-size=20000

Jetty

Set the value for property requestHeaderSize as shown below.

   <Call name="addConnector">
      <Arg>
          <New class="org.eclipse.jetty.server.nio.SelectChannelConnector">
            <Set name="host"><Property name="jetty.host" /></Set>
            <Set name="port"><Property name="jetty.port" default="8080"/></Set>
            <Set name="maxIdleTime">300000</Set>
            <Set name="requestHeaderSize">20000</Set>
            <Set name="Acceptors">2</Set>
            <Set name="statsOn">false</Set>
            <Set name="confidentialPort">8443</Set>
            <Set name="lowResourcesConnections">20000</Set>
            <Set name="lowResourcesMaxIdleTime">5000</Set>
          </New>
      </Arg>
    </Call>

score 0 · Answer 13 · answered Feb 04 '23 at 16:50

0

For Spring Boot 3,

This property is deprecated!!!

server.max-http-header-size=10MB

Use this instead.

server.max-http-request-header-size=10MB

answered Feb 04 '23 at 16:50

Knight Rider

972
2
10
22

JAVA -tomcat- Request header is too large

13 Answers13

Linked