0

I'm using org.apache.http.impl.client.CloseableHttpClient to send a request. Whenever the size of one of the headers is large (around 103452 bytes), I get a:

java.net.SocketException: Connection reset

The connection is probably not being reset by the server, since other clients from other java apps (probably using a spring OAUTH/REST client) appear to be able to use the service while sending similarly large headers.

Even though the proper fix is to avoid the need to send such a large header in the first place, is there a configuration of org.apache.http.impl.client.CloseableHttpClient that will prevent it from crashing on large headers?

The client is built with:

HttpClientBuilder.create().useSystemProperties().build()
ealfonso
  • 6,622
  • 5
  • 39
  • 67
  • How sure are you the server isn't rejecting the request? The HTTP spec doesn't impose a limit, and I don't believe the Apache client imposes one in it's default configuration. However, web servers do... See https://stackoverflow.com/questions/686217/maximum-on-http-header-values for some details. Note that the limits the web servers impose are for combined size of all headers, not a single header. – Alex Apr 20 '17 at 03:38
  • good point. I will confirm – ealfonso Apr 20 '17 at 15:42
  • Could you please add your comment as an answer? I tried sending the request to a local server: `sudo nc -l 80`. The request with a 100Kb header was sent perfectly fine by the apache http client. At the same time, I tried sending the same request to the real server via a `curl` client, and I got a `curl: (56) Proxy CONNECT aborted`. So even the proxy might be rejecting such a large header size. – ealfonso Apr 20 '17 at 18:15

1 Answers1

0

How sure are you the server isn't rejecting the request?

The HTTP spec doesn't impose a limit, and I don't believe the Apache client imposes one in it's default configuration.

However, web servers do... See Maximum on http header values? for some details. Note that the limits the web servers impose are for combined size of all headers, not a single header.

Alex
  • 2,435
  • 17
  • 18
  • you're right. it appears that the server was indeed rejecting the request, and that other successful clients were not sending large headers. this was an issue with oauth token explosion: https://www.cloudfoundry.org/blog/opaque-access-tokens-cloud-foundry/ which was fixed by limiting the requested scopes – ealfonso Jun 04 '18 at 06:46