search

tuupola / server-timing-middleware

PSR-7 & PSR-15 middleware to add the Server-Timing header
MIT License
198 stars 9 forks source link

Output can exceed header size limit #25

Open mbolli opened 5 months ago

mbolli commented 5 months ago

I got a really indescriptive error message in my logs:

[Wed Apr 10 09:33:24.816821 2024] [proxy_fcgi:error] [pid 730003] [client 10.0.0.32:52632] Premature end of script headers: index.php, referer: http://xxx
[Wed Apr 10 09:33:24.816849 2024] [proxy_fcgi:error] [pid 730003] [client 10.0.0.32:52632] AH01070: Error parsing script headers, referer: http://xxx
[Wed Apr 10 09:33:24.816856 2024] [proxy_fcgi:error] [pid 730003] (22)Invalid argument: [client 10.0.0.32:52632] AH01075: Error dispatching request to : , referer: http://xxx

After some debugging I found that the Server-Timing header was way too large, due to having too many timing entries.

On most apache configurations, the LimitRequestFieldSize variable is around 8 KB, although I don't know of a way to read it in PHP.

My proposal here is to introduce a configurable option of e.g. maxHeaderSize. This rule would be best enforced in front of this line probably: https://github.com/tuupola/server-timing-middleware/blob/411b5a606b95cc95fec222cb2ae22d2ae4690885/src/ServerTimingMiddleware.php#L139

tuupola commented 4 months ago

Dorry did not see this earlier. I need to read the spec a bit and think about this. Probably could split the data to multiple Server-Timing headers.

DanielRuf commented 2 months ago

Some additional information: I think (I did not verify this) HPACK also reduces the bytes needed for the response, when multiple header fields are used.