node.js Azure Web App returns 400 on long urls

Question

I'm hosting a node.js application in an Azure Web App. This works well, except the server always returns HTTP 400 if the request is too long (ie. a long URL or many headers.)

It seems that the error is returned by the Kestrel gateway without reaching my application, and this happens if the length of the request exceeds 2581 bytes in length. The same problem does not occur when running locally. This is a GET request, and it does not make a difference whether the URL is long, or there are long headers.

My application simply returns the current time:

// Module dependencies
let http = require('http');

http.createServer(function (request, response) {
    console.log('request ', request.url);

    response.write("Request served at " + new Date().toISOString());
    response.end();
}).listen(80);

If I request GET /anything the response is as expected. However if I do GET /{any_very_long_path} (or include a header with a long value) it fails.

Why would Azure be limiting the request length like this? The same issue does not happen when hosting an ASP.NET application.

Answer 1

If I request GET /anything the response is as expected.

However if I do GET /{any_very_long_path} ( or include a header with a long value ) it fails.

I believe the problem is related to this issue @ GitHub , it mentions :

On our website, we have pretty big cookies in some scenarios (it might not be good indeed) and we have been facing many 400 http errors since yesterday.

This is because there is a 8KB hard-coded ( HTTP_MAX_HEADER_SIZE ) limit, anything bigger returns error code 400 ...

Nodejs Documentation : http.maxHeaderSize

Read-only property specifying the maximum allowed size of HTTP headers in bytes. Defaults to 8KB. Configurable using the --max-http-header-size CLI option.

Solution :

You could try using the --max-http-header-size CLI option as the Docs mention.

Remember that if you are using a reverse proxy in-between (such as NGINX) you will also have to increase the max header size...