修改标头服务器：ArangoDB

Question

Something that seems easy, but I don't find the way to do that. Does it possible to change the header sent in a response

server: ArangoDB

by something else (in order to be less verbose and more secure) ?

Also, I need to store a large string (very long url + lot of informations) in a document, but what is the max length of a joi.string ?

Thx,

Answer 1

The internal string limit in V8 (the JavaScript engine used by ArangoDB) is around 256 MB in the V8 version used by ArangoDB. Thus 256 MB will be the absolute maximum string length that can be used from JavaScript code that's executed in ArangoDB.

Regarding maximum URL lengths as mentioned above: URLs should get too long because very long URLs may not be too portable across browsers. I think in practice several browser will enforce some URL max length limits of around 64 K, so URLs should definitely not get longer than this value. I would recommend using much shorter URLs though and passing hugh payloads in the HTTP request body instead. This also means you may need to change from HTTP GET to HTTP POST or HTTP PUT, but its at least portable.

Finally regarding the HTTP response header "Server: ArangoDB" that is sent by ArangoDB in every HTTP response: starting with ArangoDB 2.8, there is an option to turn this off: --server.hide-product-header true . This option is not available in the stable 2.7 branch yet.

Answer 2

No, there currently is no configuration to disable the server: header in ArangoDB. I would recommend prepending an NGiNX or similar HTTP-Proxy to achieve that (and other possible hardening for your service). The implementation of server header can be found in lib/Rest/HttpResponse.cpp .

Regarding Joi -

I only found howto specify a string length in joi - not what its maximum could be. I guess the general javascript limit for strings should be taken into account.

However, it rather seems that you shouldn't exceed the limit of 2000 chars for URLs which thereby should be the limit.