Headers Size

[IlyaDjurin]

In uvicorn options i can't see something similar to "--limit-request-header-size" (gunicorn). I need this option, because i have request with headers(cookies) the size of which more then 4096 bytes, and uvicorn raise exception(uvicorn.error) in FastAPI(websocket). When size less then 4096 - request ok. Suggest to me, is there solution to this issue ?

[Kludex]

The solution would be to implement that on uvicorn itself. 😅

Ref.: #157

[euri10]

what exception ?
shouldn't that be dealt upstream ?

[IlyaDjurin]

exception only in log
INFO: connection failed (400 Bad Request) {"thread": 12, "lineno": 225, "levelname": "INFO", "msg": "connection failed (400 Bad Request)", "name": "uvicorn.error", "asctime": "2022-09-27 12:26:27+00:00", "app_label": "SOCKET-SERVICE", "duration": 596, "payload": {}, "exception": {}, "query_params": {}, "response": {}, "status_code": null}

[iudeen]

@IlyaDjurin did you try this using wsproto?

uvicorn app:app --ws wsproto

Adding more context:

I tried to replicate this scenario (was trying to get started with implementing --limit-request-header-size):

Code used to test:

from websocket import create_connection

GET_REQUEST_HUGE_HEADERS = [
    "".join(
        [
            "Cookie: " + "x" * 32 * 4096,
        ]
    )
]

ws = create_connection("ws://localhost:8000/ws", header=GET_REQUEST_HUGE_HEADERS)
print("Sending 'Hello, World'...")
ws.send("Hello, World")
print("Sent")
print("Receiving...")
result = ws.recv()
print("Received '%s'" % result)

The above code fails for Websockets implementation, but works with wsproto implementation.

[iudeen]

Looking at websockets code (websockets\legacy\http.py) line 195, we see

https://github.com/aaugustin/websockets/blob/569ba1e04aa78313fd4bceb1cdae59c822682add/src/websockets/legacy/http.py#L196

    # Security: this guarantees header values are small (hard-coded = 4 KiB)
    if len(line) > MAX_LINE:
        raise SecurityError("line too long")