tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Christopher Schultz <>
Subject Re: maxHTTPHeaderSize, and specific header lengths
Date Mon, 01 Oct 2012 14:59:36 GMT
Hash: SHA1


On 10/1/12 10:33 AM, Andrew Todd wrote:
> 1) When a request is rejected for being too large, is there any 
> logging that happens or can happen in Tomcat?

Looks like you'll get an IllegalArgumentException. Easy enough to test
yourself, eh?

> 2) Apache httpd will accept a request-line of 8190 bytes. 
> Additionally, each header line can have a maximum length of 8190 
> bytes. With the default maximum of 100 request fields, this means
> that httpd will accept a header of up to (101 * 8190) = 827,190
> bytes in size.
> Let's say I'm fronting Tomcat with Apache, and I set
> maxHttpHeaderSize to 827,190 bytes so that they have the same
> limit.
> Is a byte array of that size going to be allocated for each
> incoming request, regardless of how short or long it actually is?

It will be allocated once and re-used for every request (unless you
disable such reuse).

> And, in a worst-case scenario, if all of Tomcat's default 200
> threads receive headers of 827,190 bytes at the same time, I'm
> looking at about 166 megabytes of memory allocated on the heap. Is
> that accurate?

Yes, though it will always be on the heap: there wont be any
heap-churn for those objects.

> (I think I have enough memory to handle this; GC might be a little 
> much, though).
> For the record, I'm not seriously expecting headers of this size on
> a regular basis, but wondering about the edge cases.

I think you're thinking the right way.

- -chris
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools -
Comment: Using GnuPG with Mozilla -


To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message