Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 09:45 UTC
caddyhttp: Default max_header_bytes to 16 KiB
Matthew Holt committed
Jun 9, 2026 at 12:07 UTC
4fd8c87f56e4c427727b3cdd6b034cb6d2dbb637
2 files changed
+7
-1
modules/caddyhttp/app.go
+6
@@ -257,6 +257,12 @@ func (app *App) Provision(ctx caddy.Context) error {
257
}
258
}
259
260
+ // limit max header bytes to a more reasonable default than 1MB from Go std lib
261
+ // (see https://github.com/php/frankenphp/issues/2459#issuecomment-4655612909)
262
+ if srv.MaxHeaderBytes <= 0 {
263
+ srv.MaxHeaderBytes = 16 * 1024
264
+ }
265
+
266
// if not explicitly configured by the user, disallow TLS
267
// client auth bypass (domain fronting) which could
268
// otherwise be exploited by sending an unprotected SNI
modules/caddyhttp/server.go
+1
-1
@@ -101,7 +101,7 @@ type Server struct {
101
KeepAliveCount int `json:"keepalive_count,omitempty"`
102
103
// MaxHeaderBytes is the maximum size to parse from a client's
104
- // HTTP request headers.
104
+ // HTTP request headers. Default: 16 KiB.
105
MaxHeaderBytes int `json:"max_header_bytes,omitempty"`
106
107
// Enable full-duplex communication for HTTP/1 requests.