Is there a practical HTTP Header length limit?

by

Although each web server software has some limitations, there is a difference whether there’s a limit for the HTTP request line plus header fields or for each header field.

Here’s a summary:

  • Apache 1.3, 2.0, 2.2, 2.3: 8190 Bytes (for each header field)
  • IIS:
    • 4.0: 2097152 Bytes (for the request line plus header fields)
    • 5.0: 131072 Bytes, 16384 Bytes with Windows 2000 Service Pack 4 (for the request line plus header fields)
    • 6.0: 16384 Bytes (for each header fields)
  • Tomcat:
    • 5.5.x/6.0.x: 49152 Bytes (for the request line plus header fields)
    • 7.0.x: 8190 Bytes (for the request line plus header fields)

So to conclude: To be accepted by all web servers above, a request’s request line plus header fields should not exceed 8190 Bytes. This is also the limit for each header fields (effectively even less).

More Related Contents:

  1. Are HTTP headers case-sensitive?
  2. Do I need Content-Type: application/octet-stream for file download?
  3. Custom HTTP headers : naming conventions
  4. What’s the difference between Cache-Control: max-age=0 and no-cache?
  5. Uses of content-disposition in an HTTP response header
  6. ‘Refresh’ HTTP header
  7. Difference between Pragma and Cache-Control headers?
  8. What are all the possible values for HTTP “Content-Type” header?
  9. Ideal HTTP cache control headers for different types of resources
  10. Remove http referer
  11. HTTP Range header
  12. Content-Length header with HEAD requests?
  13. Why is Cache-Control attribute sent in request header (client to server)?
  14. How to forward headers on HTTP redirect
  15. Difference between Content-Range and Range headers?
  16. What is q=0.5 in Accept* HTTP headers?
  17. Standard for adding multiple values of a single HTTP Header to a request or response
  18. What is a full specification of X-Forwarded-Proto HTTP header?
  19. Setting HTTP headers
  20. What HTTP response headers are required
  21. what characters are allowed in HTTP header values?
  22. Does the HTTP Protocol support multiple content types in response headers?
  23. What is the http-header “X-XSS-Protection”?
  24. How to evaluate http response codes from bash/shell script?
  25. What does HTTP/1.1 302 mean exactly?
  26. HTTP Cache Control max-age, must-revalidate
  27. Is the Content-Length header required for a HTTP/1.0 response?
  28. Is REST DELETE really idempotent?
  29. Avoid caching of the http responses
  30. S3: How to do a partial read / seek without downloading the complete file?

Leave a Comment