Lack of information when max header size is exceeded
- Dominant language
- No language data
- Stars
- 126
- Forks
- 26
- PR merge metrics
- No merged PRs in 30d
Description
# Bug description
knot.x doesn't inform that max HTTP header size was exceeded. `knotx.log` contains no information about that (tested with `INFO` and `DEBUG` log levels). Additionally 400 response is not logged in `knotx-access.log` file.
knot.x version: `1.4.0` and `1.5.0`
# Steps to reproduce
1. Download knot.x ACME example from [here](https://bintray.com/knotx/downloads/examples) (either `1.4.0` or `1.5.0`)
2. Run knot.x: `./bin/knotx run-knotx`
3. Send HTTP request with long `Cookie` header
```
$ curl http://localhost:8092/whatever -H "Cookie: test=$(openssl rand -base64 6093 | tr -d "\n")" -o /dev/null -SsD -
HTTP/1.1 404 Not Found
X-Server: Knot.x-Example
Content-Type: text/plain
Content-Length: 20
```
4. Send even longer cookie
```
$ curl http://localhost:8092/whatever -H "Cookie: test=$(openssl rand -base64 6094 | tr -d "\n")" -o /dev/null -SsD -
HTTP/1.1 400 Bad Request
```
# Expected behavior
* knot.x should clearly point out in `knotx.log` that max header size was exceeded. Right now there's no such information whatsoever
* 400 responses should be logged in `knotx-access.log` file
# Screenshots
N/A
# Additional context
The issue got discovered by accident, because we had to increase max header size in the past for Apache (one of the endpoints we talk to sets quite long cookies that exceed `8192` default vert.x limit). @Skejven pointed out we can increased that in `server.conf` via `maxHeaderSize = 16384` option and this is what we did. That doesn't change the fact that it'd quite hard to debug if we haven't had that situation with Apache before.
Contributor guide
Research direction
Start with the ACME example and the server.conf maxHeaderSize setting, then reproduce the two curl requests with oversized Cookie headers. Inspect how HTTP 400 responses and header-size failures are handled for knotx.log and knotx-access.log. Done means the size-exceeded condition is identifiable in knotx.log and the 400 response appears in the access log.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, observability
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100