René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Increase HTTP_MAX_HEADER_SIZE to 16kb","articleBody":"**Is your feature request related to a problem? Please describe.**\r\nNode recently introduced a [security fix](https://www.nearform.com/blog/protecting-node-js-from-uncontrolled-resource-consumption-headers-attacks/) that decreased the max header size to 8kb https://github.com/nodejs/node/commit/186035243fad247e3955fa0c202987cae99e82db. This has caused problems for users who are using APIs that pass large amounts of data via headers. One example: https://github.com/Azure/azure-cosmos-js/issues/221. Node users running in managed environments like FaaS cloud services are unable to set the `--max-http-header-size` CLI flag. More examples in https://github.com/nodejs/node/issues/24692\r\n\r\n**Describe the solution you'd like**\r\nIncrease the max header size to 16kb. [This StackOverflow issue](https://stackoverflow.com/questions/1097651/is-there-a-practical-http-header-length-limit/6160643#6160643) outlines the max header size for various web servers and 16kb is the maximum for IIS which is used in many of our APIs. It seems to me that 16kb is a more reasonable default with the widespread usage of IIS. Assuming of course that 16kb is still secure given the vulnerability present when the default value was 80kb.\r\n\r\n**Describe alternatives you've considered**\r\nIn our case, I am also working to solve this issue on the API side, but in some cases, for legacy production APIs it is just not possible to decrease our header usage.\r\n\r\n@mcollina @bnb \r\n","author":{"url":"https://github.com/southpolesteve","@type":"Person","name":"southpolesteve"},"datePublished":"2019-05-10T22:50:50.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":21},"url":"https://github.com/27645/node/issues/27645"}