4

I have an ASP.Net 4.0 application using Windows Integrated Authentication on IIS7.5 on Windows 2003.

Some users are reporting errors with this message:

Bad Request - Request Too Long

HTTP Error 400. The size of the request headers is too long.

Others succeed in loading pages but have errors loading other resources and performing AJAX calls.

One of the users experiencing intermittent errors has a Kerberos Authorization header of about 5700 characters. This user is a member of 250 AD groups. My theory is that other HTTP headers (inc cookies) may take the total beyond 8000 characters, which if encoded using UTF16, totals over the default 16KB limit.

This page describes using web.config to configure limits on each HTTP header: http://www.iis.net/configreference/system.webserver/security/requestfiltering/requestlimits/headerlimits

This page describes using registry settings to set limits on HTTP header size and total request size, by default both 16KB: https://support.microsoft.com/en-us/kb/820129

  1. Do the web.config settings override the HTTP.sys registry settings?
  2. If so, is there a web.config setting for the total request size?
Community
  • 1
  • 1
Emyr
  • 2,351
  • 18
  • 38
  • 1
    how did you fix it? – Jitendra Pancholi Dec 21 '18 at 12:49
  • Increased the HTTP.sys limits AND switched to use HTML5 Local Storage for user preferences that didn't need to be included in every request and response. – Emyr Jan 04 '19 at 16:28
  • This page describes the problem with Kerberos & too many AD Groups, and how to fix it: https://learn.microsoft.com/en-us/troubleshoot/iis/http-bad-request-response-kerberos – Rory May 26 '21 at 09:05

2 Answers2

2
  1. The registry one takes high priority as the driver is the entry point of packets. It is also a server wide setting for all incoming HTTP packets.

The request filtering setting only takes effect when the packets are forwarded to IIS pipeline. It can be set at multiple levels to achieve fine grained control.

  1. There does not seem to be a setting for that.
Lex Li
  • 60,503
  • 9
  • 116
  • 147
0

Have you tried clearing your cookies within your browser?

It could be possible that you have an overly large number of cookies being stored that will be added to any and all requests made within your browser. This can sometimes lead to issues like this. Additionally, you could try running your application within a different browser to see if that affects anything.

Saurin
  • 1,650
  • 1
  • 10
  • 8
  • 1
    Hi. This question is 18 months old. Testing with different browsers and cleared cookies is how we identified the size of the auth header as the main issue. – Emyr Oct 09 '17 at 14:47