Question 91507 in Apache Question posted in
Some documentation to get you started can be found here.

Why need to set limit with http request header? – Apache

Why need to set limit with http request header?

Everyone knows that the request header is limited( tomcat 8k…),
but I can’t find any information why it should be.

Is it related to buffer overflow attacks?

Thank you.

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    I think I found the answer to my curiosity in the apache security book.

    Properly configured limits mitigate buffer overflow exploits, preventing Denial of Service (DoS) attacks.


  2. 0

    HTTP doesn’t impose limits.

    However, if server doesn’t impose limits it means that a client could (for example) make a HTTP requests with a header that’s many gigabytes in size.

    If the server did not set a limit, it would mean that the server has to wait until the client is done sending the header, and in the meanwhile the server has to collect this header in memory, perhaps even exceeding the total memory of the server.

    If this were possible, clients could construct HTTP requests that crash servers. To prevent this, servers set limits.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search