431 Request Header Fields Too Large

GET /dashboard HTTP/1.1
Host: api.example.com
Cookie: session=ey...[10,000 bytes of data]...
Authorization: Bearer ey...[Another 10,000 bytes]...

// Node.js handles this automatically at the HTTP server level.
// By default, Node.js limits headers to 16KB (previously 8KB).
// You can change this limit when starting the node process:
// node --max-http-header-size=32768 server.js

// If you wanted to manually check a specific header size in Express:
app.use((req, res, next) => {
  if (req.headers.authorization && req.headers.authorization.length > 8192) {
    return res.status(431).send("Authorization header too large");
  }
  next();
});

# Uvicorn (FastAPI's default server) handles header limits automatically via h11.
# You can increase the limit using the --limit-max-field-size flag.
# uvicorn main:app --limit-max-field-size 16384

@app.get("/")
def read_root(request: Request):
    # This code only runs if the server hasn't already rejected it with 431
    return {"message": "Headers were an acceptable size"}

// In Go, the max header size is controlled by the Server struct.
// If exceeded, Go's HTTP server automatically returns 431.

server := &http.Server{
    Addr:           ":8080",
    Handler:        myHandler,
    MaxHeaderBytes: 1 << 20, // 1 MB (Default is 1MB)
}
server.ListenAndServe()

// Kestrel handles header limits automatically.
// You can configure it in Program.cs:

builder.WebHost.ConfigureKestrel(options => {
    options.Limits.MaxRequestHeadersTotalSize = 32768; // default is 32KB
    options.Limits.MaxRequestHeaderCount = 100;
});

curl -v http://localhost:8080/ \
  -H "X-Massive-Header: $(head -c 20000 < /dev/zero | tr '\0' 'A')"