Knotx / knotx

Knot.x is a highly-efficient and scalable integration framework designed to build backend APIs
https://knotx.io
Apache License 2.0
126 stars 26 forks source link

Lack of information when max header size is exceeded #480

Open jwadolowski opened 5 years ago

jwadolowski commented 5 years ago

Bug description

knot.x doesn't inform that max HTTP header size was exceeded. knotx.log contains no information about that (tested with INFO and DEBUG log levels). Additionally 400 response is not logged in knotx-access.log file.

knot.x version: 1.4.0 and 1.5.0

Steps to reproduce

  1. Download knot.x ACME example from here (either 1.4.0 or 1.5.0)
  2. Run knot.x: ./bin/knotx run-knotx
  3. Send HTTP request with long Cookie header
$ curl http://localhost:8092/whatever -H "Cookie: test=$(openssl rand -base64 6093 | tr -d "\n")" -o /dev/null -SsD -
HTTP/1.1 404 Not Found
X-Server: Knot.x-Example
Content-Type: text/plain
Content-Length: 20
  1. Send even longer cookie
$ curl http://localhost:8092/whatever -H "Cookie: test=$(openssl rand -base64 6094 | tr -d "\n")" -o /dev/null -SsD -
HTTP/1.1 400 Bad Request

Expected behavior

Screenshots

N/A

Additional context

The issue got discovered by accident, because we had to increase max header size in the past for Apache (one of the endpoints we talk to sets quite long cookies that exceed 8192 default vert.x limit). @Skejven pointed out we can increased that in server.conf via maxHeaderSize = 16384 option and this is what we did. That doesn't change the fact that it'd quite hard to debug if we haven't had that situation with Apache before.