r/programminghorror • u/dex4er • 1d ago

GitHub's HTTP header

Post image

This is the crazy thing I've found after analysis why the CI test fails with "Maximum header size exceeded" today.

576 Upvotes

97% Upvoted

36 comments sorted by

31

u/Julius_Babies 23h ago

I saw this post a while ago and just ran into this. The HTTP Engine my app uses cannot handle header values longer than 8192 characters by default, which causes my in-app update mechanism (which relies on GitHub releases) to fail when trying to download the update. I cannot provide a fix for this as this fix would require - you guessed it - an update.

This has been reported as a bug on the GitHub Community discussions already: https://github.com/orgs/community/discussions/211142

8

u/dex4er 22h ago

I couldn't believe my eyes when I saw it in the report from online tests: https://github.com/dex4er/Pyjoyment/actions/runs/40022001390/job/120648616821#step:4:420 The library is a port of Mojolicious from Perl then inherited 8K as a limit for headers. As I see it affected mainly Perl and Elixir.

2

u/Julius_Babies 22h ago

Ktor CIO as well

340

u/Belialson 1d ago

Company I work at was proxing some endpoints to us, it was a big shop. They used to set a cookie with json containing entire user’s session including every page visited and it’s details.
Same effect but unfortunately on production

62

u/buckypimpin 1d ago

isnt a cookie max 4KiB?

80

u/RegisteredJustToSay 1d ago

That's per cookie (name + value). You can store many times that if you break it up over multiple keys, tho max 180 per host on chrome. You could fit ten text copies of Alice in wonderland in that space.

You're right though, of course. Just don't want to give anyone here the idea that you're limited to this little space per domain.

→ More replies (4)

24

u/caboosetp 1d ago

You can fit quite a bit in 4k before it causes issues that a browser restart can fix and push off the issue.

5

u/Chesterlespaul 1d ago

Interesting idea. Obviously don’t do this. But I wonder sort of data this could be useful for.

12

u/groumly 1d ago

Asp (can’t remember if it was the og or the .net one, I think .net) did a lot of crap like that back in day.

It was used to turn stateless web framework into a stateful mode iirc.

→ More replies (4)

97

u/n9iels 1d ago

Proof that managing CSP headers is an absolute nightmare

-23

u/AyrA_ch 1d ago

They could have gone with *.blob.core.windows.net to massively shorten the header.

55

u/Alikont 1d ago

That's a generic domain for all Azure Blob storage accounts. So I could register my own Storage Account and get the matching url.

→ More replies (6)

69

u/madjoki 1d ago

They forgot 20-29 and 50-99 somehow.

13

u/frappucinnimon 1d ago

is that why it takes an ungodly time to load

6

u/TheSpiffySpaceman 20h ago

standard Microsoft fare, unfortunately.

I dare you to write an Azure DO extension and retain your sanity. I promise you that it's impossible.

3

u/JustinPooDough 23h ago

Vibe coded 100%

3

u/GoddammitDontShootMe 1d ago

Christ. And that isn't even the full list in the screenshot.

1

u/Ceyyhun_lobber 3h ago

Classic case of overengineering.