Knotx / Knotx/knotx

Lack of information when max header size is exceeded

Open
#480 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
No language data
Stars
126
Forks
26
PR merge metrics
No merged PRs in 30d

Description

# Bug description

knot.x doesn't inform that max HTTP header size was exceeded. `knotx.log` contains no information about that (tested with `INFO` and `DEBUG` log levels). Additionally 400 response is not logged in `knotx-access.log` file.

knot.x version: `1.4.0` and `1.5.0`

# Steps to reproduce

1. Download knot.x ACME example from [here](https://bintray.com/knotx/downloads/examples) (either `1.4.0` or `1.5.0`)
2. Run knot.x: `./bin/knotx run-knotx`
3. Send HTTP request with long `Cookie` header

```
$ curl http://localhost:8092/whatever -H "Cookie: test=$(openssl rand -base64 6093 | tr -d "\n")" -o /dev/null -SsD -
HTTP/1.1 404 Not Found
X-Server: Knot.x-Example
Content-Type: text/plain
Content-Length: 20
```

4. Send even longer cookie

```
$ curl http://localhost:8092/whatever -H "Cookie: test=$(openssl rand -base64 6094 | tr -d "\n")" -o /dev/null -SsD -
HTTP/1.1 400 Bad Request
```

# Expected behavior

* knot.x should clearly point out in `knotx.log` that max header size was exceeded. Right now there's no such information whatsoever
* 400 responses should be logged in `knotx-access.log` file

# Screenshots

N/A

# Additional context

The issue got discovered by accident, because we had to increase max header size in the past for Apache (one of the endpoints we talk to sets quite long cookies that exceed `8192` default vert.x limit). @Skejven pointed out we can increased that in `server.conf` via `maxHeaderSize = 16384` option and this is what we did. That doesn't change the fact that it'd quite hard to debug if we haven't had that situation with Apache before.

Contributor guide

Open the contributing guide

Research direction

Start with the ACME example and the server.conf maxHeaderSize setting, then reproduce the two curl requests with oversized Cookie headers. Inspect how HTTP 400 responses and header-size failures are handled for knotx.log and knotx-access.log. Done means the size-exceeded condition is identifiable in knotx.log and the 400 response appears in the access log.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, observability
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.