Skip to main content

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [jetty-users] Http Request Header Size Limit

The defaults of 8KB are based on experience with various browsers, http clients, (networking) hardware, proxies, etc ...

While it is possible to increase those values, you run a high risk of suddenly experiencing failures in your various clients to reach Jetty, let alone Jetty being in a position to even process the request.  The failures can occur on the server side load balancer, intermediate networking hardware, transparent proxies on network providers, client side proxies, faults in client libraries, differences in client libraries, mobile networking differences, etc...

We generally only recommend increasing those values for environments where you control the entire chain (client -> network -> server) and can validate all pieces of the chain to ensure that it will work sanely.

There is also a number of vulnerabilities present in large HTTP headers related to Hashmap collisions which allow an arbitrarily small number of users and clients to DDOS the CPU and memory of the machine with relatively few requests.  This is another reason the 8KB maximum has settle into common use across the industry.

As for memory calculations, there is no 1::1 relationship of memory use to connection count.
The memory comes from preallocated BufferPools and are reused as-needed.  
It would be difficult to have all 10k connections each having a buffer of their own at the exact same time.
As for a calculation or a rule of thumb on how your memory will behave, that's impossible to prescribe without knowing your application and client access behavior intimately first.



--
Joakim Erdfelt <joakim@xxxxxxxxxxx>
Expert advice, services and support from from the Jetty & CometD experts

On Thu, Apr 30, 2015 at 5:38 PM, Huaping Gu <humphrey.gu@xxxxxxxxx> wrote:
Hi Jetty users,
Any one has best practice on Jetty HTP Header size limit setting?

For Jetty, the header size can be configured in HttpConfiguration, default like bellow (8k bytes):


private int _requestHeaderSize=8*1024;
private int _responseHeaderSize=8*1024;
For some reason, we need to increase the header size (it is arguable why need such a big header? It is because of some special cookie).  The concern is header is attache to HTTPChannel which is 1:1 to connection or 1:n to SPDY connection (from Jetty Doc). If we have 10k connections, every 8k header size increase will introduce 80M memory usage (should more if calculated with JVM data structure overhead). 80M seems not too big in modern box.  Are there anyone here ever did this kind of testing on Jetty, or benchmark?  What is the optimal header size and any concern factors we need to take care?  Throughput (traffic, volume), latency?
thanks
Huaping Gu




_______________________________________________
jetty-users mailing list
jetty-users@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://dev.eclipse.org/mailman/listinfo/jetty-users


Back to the top