You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by "Martucci, Andy" <AM...@Premierfarnell.com> on 2009/11/25 10:11:34 UTC
[users@httpd] CGI Apache Directive: LimitRequestLine
Hi, I'm hoping that you can help me with an issue we have come across regarding some new development we're doing around the use of CGI Apache web services.
I work in the Systems department for Premier Farnell (Leeds), we had an in-house course a while back that was presented by Paul Tuohy.. this was intended to give us an insight into CGI Apache and what it could do for our business... hence this email now.
Our problem is this... we want to provide a web service that will provide a real time data link between our AS400 and web sites... we have achieved this without a problem using a url "get" request to the CGI Apache server on the AS400.
However, the problem we have stumbled onto is the maximum size of the query string that we can use... this is limited to 8190 bytes... I believe this is a "Directive" constraint in Apache called: LimitRequestLine
We understand that there isn't such a limit using a "post" request but before we re-develop everything we have done we wanted to make sure that there wasn't anything we could do to get around the constraint I have just mentioned. We would be looking at a maximum size more in the region of 32k.
I'd be very grateful if you could me what the "correct" course of action should be to resolve this problem please?
Regards, Andy.
> Andy Martucci
>
> GIS Back Office
Premier Farnell
> amartucci@premierfarnell.com
>
> T: +44 113 279 0101 (ext 4087)
> F: +44 113 279 9168
www.farnell.com
A Premier Farnell Company
***************************Disclaimer***************************
The contents of this e-mail and any file transmitted with it are confidential and intended solely for the individual or entity to whom they are addressed. The content may also contain legal, professional or other privileged information. If you received this e-mail in error, please destroy it immediately. You should not copy or use it for any purpose nor disclose its contents to any other person. The views stated herein do not necessarily represent the view of the Company. Please ensure you have adequate virus protection before you open or detach any documents from this transmission. The Company does not accept any liability for viruses.
Premier Farnell plc
150 Armley Road Leeds
LS12 2QQ
Telephone +44 (0) 870 129 8608
Fax +44 (0) 870 129 8610
Registered in England
Company Number 876412
Registered Office: Farnell House, Forge Lane, Leeds LS12 2NE ************************************************************
Re: [users@httpd] CGI Apache Directive: LimitRequestLine
Posted by Nick Kew <ni...@webthing.com>.
Hendrik Schmieder wrote:
> Do you know the rfc number for 'HTTP spec limits it to 2kb' ?.
I said IIRC, and it's a memory from a long time ago - pre-rfc2616.
It may no longer be valid, but it was standard advice in the early
days: don't make GET requests bigger than 2k.
Of course, no standard limits the size. It just says (said)
that an implementation should not impose a lower limit.
The rest of what I said stands: if someone presents me with
a system where an 8k limit is a problem, my reaction is to
question the design decisions that led to it.
--
Nick Kew
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] CGI Apache Directive: LimitRequestLine
Posted by Hendrik Schmieder <he...@jedox.com>.
Nick Kew schrieb:
> On 25 Nov 2009, at 10:18, Martucci, Andy wrote:
>
>> I've been reliably informed that 8190 bytes is the maximum size available for the get method and anything over this should be done using the post method.
>
> IIRC the HTTP spec limits it to 2kb, so you can't rely on any agent (server, browser
> or proxy) allowing you more than that.
>
> If you want apache to support longer lines (subject to all other agents you use also
> doing so), build it with your selected value in include/httpd.h, where the limit is defined.
>
> But the need to do any such thing smells of a design defect in your application
> (and how do you deal with logging these huge requests - 8K log for a single
> request)?
>
Do you know the rfc number for 'HTTP spec limits it to 2kb' ?.
I can't find such a statement in rfc2616.
Hendrik
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] CGI Apache Directive: LimitRequestLine
Posted by Nick Kew <ni...@webthing.com>.
On 25 Nov 2009, at 10:18, Martucci, Andy wrote:
> I've been reliably informed that 8190 bytes is the maximum size available for the get method and anything over this should be done using the post method.
IIRC the HTTP spec limits it to 2kb, so you can't rely on any agent (server, browser
or proxy) allowing you more than that.
If you want apache to support longer lines (subject to all other agents you use also
doing so), build it with your selected value in include/httpd.h, where the limit is defined.
But the need to do any such thing smells of a design defect in your application
(and how do you deal with logging these huge requests - 8K log for a single
request)?
--
Nick Kew
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] CGI Apache Directive: LimitRequestLine
Posted by "Martucci, Andy" <AM...@Premierfarnell.com>.
I've been reliably informed that 8190 bytes is the maximum size available for the get method and anything over this should be done using the post method.
Thanks to all that took the time to look at this for me.
Regards, Andy.
-----Original Message-----
From: Philip Wigg [mailto:phil@philipwigg.co.uk]
Sent: 25 November 2009 09:39
To: users@httpd.apache.org
Subject: Re: [users@httpd] CGI Apache Directive: LimitRequestLine
> Alas that isn't possible... there is a constraint in Apache that limits this to 8190... see following help text from Apache:
<snip>
> Default: places 8190 in the edit field and "Bytes" in the first drop-down menu.
> Maximum: places 8190 in the edit field and "Bytes" in the first drop-down menu.
Talk of drop-down menus confuses me, I don't think this text is from
the Apache Software Foundation. Are you using the IBM HTTP Server or
similar?
You can certainly increase LimitRequestLine in Apache 2.2:-
http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestline
but I think you're probably using some repackaged version of 1.3 which
does have a compiled in limit as you describe. If so I can't think of
any way to increase it.
Cheers,
Phil.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Click on the link below to report this email as spam.
https://www.mailcontrol.com/sr/wQw0zmjPoHdJTZGyOCrrhg==
***************************Disclaimer***************************
The contents of this e-mail and any file transmitted with it are confidential and intended solely for the individual or entity to whom they are addressed. The content may also contain legal, professional or other privileged information. If you received this e-mail in error, please destroy it immediately. You should not copy or use it for any purpose nor disclose its contents to any other person. The views stated herein do not necessarily represent the view of the Company. Please ensure you have adequate virus protection before you open or detach any documents from this transmission. The Company does not accept any liability for viruses.
Premier Farnell plc
150 Armley Road Leeds
LS12 2QQ
Telephone +44 (0) 870 129 8608
Fax +44 (0) 870 129 8610
Registered in England
Company Number 876412
Registered Office: Farnell House, Forge Lane, Leeds LS12 2NE ************************************************************
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] CGI Apache Directive: LimitRequestLine
Posted by "Martucci, Andy" <AM...@Premierfarnell.com>.
Sorry, yes that snippet was taken from the Server... Directive.
OK then I can certainly look into what you have said, I had thought we were on the latest version but maybe we aren't.
When I've spoken to our Ops team I'll get back to you.
Many thanks for taking the time to respond, very much appreciated.
Regards, Andy.
-----Original Message-----
From: Philip Wigg [mailto:phil@philipwigg.co.uk]
Sent: 25 November 2009 09:39
To: users@httpd.apache.org
Subject: Re: [users@httpd] CGI Apache Directive: LimitRequestLine
> Alas that isn't possible... there is a constraint in Apache that limits this to 8190... see following help text from Apache:
<snip>
> Default: places 8190 in the edit field and "Bytes" in the first drop-down menu.
> Maximum: places 8190 in the edit field and "Bytes" in the first drop-down menu.
Talk of drop-down menus confuses me, I don't think this text is from
the Apache Software Foundation. Are you using the IBM HTTP Server or
similar?
You can certainly increase LimitRequestLine in Apache 2.2:-
http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestline
but I think you're probably using some repackaged version of 1.3 which
does have a compiled in limit as you describe. If so I can't think of
any way to increase it.
Cheers,
Phil.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Click on the link below to report this email as spam.
https://www.mailcontrol.com/sr/wQw0zmjPoHdJTZGyOCrrhg==
***************************Disclaimer***************************
The contents of this e-mail and any file transmitted with it are confidential and intended solely for the individual or entity to whom they are addressed. The content may also contain legal, professional or other privileged information. If you received this e-mail in error, please destroy it immediately. You should not copy or use it for any purpose nor disclose its contents to any other person. The views stated herein do not necessarily represent the view of the Company. Please ensure you have adequate virus protection before you open or detach any documents from this transmission. The Company does not accept any liability for viruses.
Premier Farnell plc
150 Armley Road Leeds
LS12 2QQ
Telephone +44 (0) 870 129 8608
Fax +44 (0) 870 129 8610
Registered in England
Company Number 876412
Registered Office: Farnell House, Forge Lane, Leeds LS12 2NE ************************************************************
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] CGI Apache Directive: LimitRequestLine
Posted by Philip Wigg <ph...@philipwigg.co.uk>.
> Alas that isn't possible... there is a constraint in Apache that limits this to 8190... see following help text from Apache:
<snip>
> Default: places 8190 in the edit field and "Bytes" in the first drop-down menu.
> Maximum: places 8190 in the edit field and "Bytes" in the first drop-down menu.
Talk of drop-down menus confuses me, I don't think this text is from
the Apache Software Foundation. Are you using the IBM HTTP Server or
similar?
You can certainly increase LimitRequestLine in Apache 2.2:-
http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestline
but I think you're probably using some repackaged version of 1.3 which
does have a compiled in limit as you describe. If so I can't think of
any way to increase it.
Cheers,
Phil.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] CGI Apache Directive: LimitRequestLine
Posted by "Martucci, Andy" <AM...@Premierfarnell.com>.
Hi Phil
Alas that isn't possible... there is a constraint in Apache that limits this to 8190... see following help text from Apache:
Maximum request line: allows you to reduce the limit on the allowed size of a client's HTTP request-line below the normal input buffer size compiled with the server. Since the request-line consists of the HTTP method, URI, and protocol version, this option restricts the length of the request-URI. A server needs this value to be large enough to hold any of its resource names, including any information that might be passed in the QUERY_STRING part of a GET request. This option gives the server administrator greater control over abnormal client request behavior, which may be useful for avoiding some forms of denial-of-service attacks. Under normal conditions, the value should not be changed from the default. Valid values include integers between 0 and 8190. The first drop-down menu specifies units of memory. The second drop-down menu provides the options:
Default: places 8190 in the edit field and "Bytes" in the first drop-down menu.
Maximum: places 8190 in the edit field and "Bytes" in the first drop-down menu.
This field is optional. Directive: LimitRequestLine
Regards, Andy.
-----Original Message-----
From: Philip Wigg [mailto:phil@philipwigg.co.uk]
Sent: 25 November 2009 09:23
To: users@httpd.apache.org
Subject: Re: [users@httpd] CGI Apache Directive: LimitRequestLine
> However, the problem we have stumbled onto is the maximum size of the query
> string that we can use... this is limited to 8190 bytes... I believe this is
> a "Directive" constraint in Apache called: LimitRequestLine
>
> We understand that there isn't such a limit using a "post" request but
> before we re-develop everything we have done we wanted to make sure that
> there wasn't anything we could do to get around the constraint I have just
> mentioned. We would be looking at a maximum size more in the region of 32k.
8190 bytes is the default but you increase it by specifying a larger
limit in your httpd.conf. Putting something like:-
LimitRequestLine 32768
should do it if that's all the problem is.
Cheers,
Phil.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Click on the link below to report this email as spam.
https://www.mailcontrol.com/sr/wQw0zmjPoHdJTZGyOCrrhg==
***************************Disclaimer***************************
The contents of this e-mail and any file transmitted with it are confidential and intended solely for the individual or entity to whom they are addressed. The content may also contain legal, professional or other privileged information. If you received this e-mail in error, please destroy it immediately. You should not copy or use it for any purpose nor disclose its contents to any other person. The views stated herein do not necessarily represent the view of the Company. Please ensure you have adequate virus protection before you open or detach any documents from this transmission. The Company does not accept any liability for viruses.
Premier Farnell plc
150 Armley Road Leeds
LS12 2QQ
Telephone +44 (0) 870 129 8608
Fax +44 (0) 870 129 8610
Registered in England
Company Number 876412
Registered Office: Farnell House, Forge Lane, Leeds LS12 2NE ************************************************************
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] CGI Apache Directive: LimitRequestLine
Posted by Philip Wigg <ph...@philipwigg.co.uk>.
> However, the problem we have stumbled onto is the maximum size of the query
> string that we can use... this is limited to 8190 bytes... I believe this is
> a "Directive" constraint in Apache called: LimitRequestLine
>
> We understand that there isn't such a limit using a "post" request but
> before we re-develop everything we have done we wanted to make sure that
> there wasn't anything we could do to get around the constraint I have just
> mentioned. We would be looking at a maximum size more in the region of 32k.
8190 bytes is the default but you increase it by specifying a larger
limit in your httpd.conf. Putting something like:-
LimitRequestLine 32768
should do it if that's all the problem is.
Cheers,
Phil.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org