JIYIK CN >

I recently discovered error responses from a Node JS microservice with the HTTP error "431 Request Header Fields Too Large", but at first it seemed to be intermittent, depending on the test environment used. Further investigation revealed it to be a Node setting for maximum header size as well as a Node JS version change and some large cookies.

Error 431 Request Header Fields Too Large HTTP error indicates that the total size of the request headers (including cookies) is too large for the web server to accept. This usually happens when a large cookie has been established to maximize the request size.

In 2018, Node (version 11.6.0) was updated to address a security vulnerability in this area — Denial of Service with Large HTTP Headers (CVE-2018–12121), which resulted in the default maximum request header size being reduced to 8kb (from 16kb), interestingly 8kb was chosen because it was the default for NGINX at the time. The default limit was eventually increased to 16kb in v13.13.0, meaning that if you happened to be running on a version of Node between 11.6 and 13.13, you would be facing the 8kb limit, but not on versions before or after those versions, but on 16kb — which is what I recently ran into.

If the default maximum header size for your node installation isn't working for you, -max-http-header-sizeit's easy to configure a new value using the config parameter.

--max-http-header-size=16250

Of course, we should not set this value too high, but should configure it as low as possible for our specific application.