Repository navigation
Request timeout if a single header exceeds the max-http-header-size limit #25858
Description
- Version: 10.15.1
- Platform: 18.2.0 Darwin Kernel Version 18.2.0: Thu Dec 20 20:46:53 PST 2018; root:xnu-4903.241.1~1/RELEASE_X86_64 x86_64
- Subsystem: http
If a request header exceeds the max-http-header-size in Node 10.15.1 and 10.15.0 the request hangs leaving the socket open until the server times out. This seems like it could be a potential DoS attack vector. On Node 10.14.1 a 400 response is received as expected. The code below demonstrates the issue. If you run the code on 10.14.1 both requests will return immediately with a 400 as expected. On 10.15.1 the second request times out.
You can grab the test script from here also. https://github.com/natedanner/node-max-header-timeout/blob/master/server.js
const http = require('http');
const port = 3000;
const server = http.createServer((req, res) => {
res.writeHead(200, {'Content-Type': 'text/plain; charset=UTF-8'});
res.end('Hello World\n');
})
server.listen(port, () => {
console.log(`Listening on ${port}`);
// Headers that together exceed default 8k limit
const defaultHeaders = {
'FOO': '6'.repeat(8100),
'BAR': '6'.repeat(8192)
};
function callServer(callerName, headers) {
return http.get('http://localhost:3000', { headers }, (response) => {
console.log(callerName, 'responded with:', response.statusCode);
});
}
const excessHeadersRequest = callServer('EXCESS_HEADER', defaultHeaders);
excessHeadersRequest.setTimeout(2000, () => {
console.log('SHOULD NOT SEE THIS');
});
// If you exceed header limit on a single header by 1 then the request hangs open
defaultHeaders['BAR'] += '6'
const headerTimeoutRequest = callServer('EXCESS_HEADER_TIMEOUT', defaultHeaders);
headerTimeoutRequest.setTimeout(2000, () => {
console.log('EXCESS_HEADER_TIMEOUT CALL TIMED OUT!');
});
});
Activity
[-]Request timeout on max-http-header-size if a single header exceeds the limit[/-][+]Request timeout if a single header exceeds the max-http-header-size limit[/+]mscdex commentedon Feb 1, 2019
FWIW this works on master, so there's just a commit/change that needs to be backported it seems.
mscdex commentedon Feb 1, 2019
Found the change, will create a PR.
http: fix error check in `Execute()`
http: fix error check in `Execute()`
http: fix error check in `Execute()`
http: fix error check in `Execute()`
mmarchini commentedon Feb 6, 2020
I believe this was fixed on 10.15.3 (although I haven't tested it). Can this issue be closed?
mmarchini commentedon Feb 7, 2020
Ok, so I tried on v10.14.0, v10.15.1 and v10.15.3, and v10.19.0 the issue seems resolved on 10.15.3 and onwards.
Based on that, I'm closing this issue. Feel free to reopen if I missed something though.
thomas-zhou commentedon Feb 16, 2022
@mmarchini we encountered this issue in the latest node version 14.19.0, may I know whether this issue has been fixed in v14? From the PR I only see that it has been fixed in v6, v8 and v10. thanks!