Max-Http-Request-Header-Size in Spring Boot

Refactor Java code safely — and automatically — with OpenRewrite.

Refactoring big codebases by hand is slow, risky, and easy to put off. That’s where OpenRewrite comes in. The open-source framework for large-scale, automated code transformations helps teams modernize safely and consistently.

Each month, the creators and maintainers of OpenRewrite at Moderne run live, hands-on training sessions — one for newcomers and one for experienced users. You’ll see how recipes work, how to apply them across projects, and how to modernize code with confidence.

Join the next session, bring your questions, and learn how to automate the kind of work that usually eats your sprint time.

Distributed systems often come with complex challenges such as service-to-service communication, state management, asynchronous messaging, security, and more.

Dapr (Distributed Application Runtime) provides a set of APIs and building blocks to address these challenges, abstracting away infrastructure so we can focus on business logic.

In this tutorial, we'll focus on Dapr's pub/sub API for message brokering. Using its Spring Boot integration, we'll simplify the creation of a loosely coupled, portable, and easily testable pub/sub messaging system:

>> Flexible Pub/Sub Messaging With Spring Boot and Dapr

1. Overview

Spring Boot web applications include a pre-configured, embedded web server by default. In some situations, though, we’d like to modify the default configuration to meet custom requirements.

In this tutorial, we’ll see how to set up and use the server.max-http-request-header-size property for request headers in the application.properties file in a Spring Boot application.

2. server.max-http-request-header-size

Spring Boot supports Tomcat, Undertow, Netty, and Jetty as embedded servers. In general, we write the server configurations inside the application.properties file or application.yaml file in a Spring Boot application.

Before Spring Boot 3, we can set the default header by defining server.max-http-header-size in the properties file. However, this property behaves differently on the embedded server. When used with Tomcat, it configures both the maximum HTTP request and response header sizes. On the other hand, it configures only the maximum HTTP request header size when the embedded server is Undertwow, Netty, or Jetty.

Spring Boot 3.0 addresses these differences by deprecating server.max-http-header-size and replace with server.max-http-request-header-size. The properties now apply to request header size for the embedded server.

Furthermore, we can configure the maximum response header by implementing the WebServerFactoryCustomizer interface. Notably, this property is supported only by Tomcat and Jetty.

Most web servers have their own set of size limits for HTTP request headers. The HTTP header values are restricted by server implementations.

The actual default value for Tomcat and Jetty is 8kB, and the default value for Undertow is 1MB.

To modify the max HTTP header size, we’ll add the property to our application.properties file:

server.max-http-request-header-size=20000

Likewise for the application.yaml format:

server:
    max-http-request-header-size: 20000

From Spring Boot 2.1, we’ll now use a DataSize parsable value:

server.max-http-request-header-size=10KB

3. Request Header Is Too Large

Suppose a request is sent where the total HTTP header size is larger than the max-http-header-size value. The server rejects the request with a “400 Bad request” error. We’ll see this error in our log file in the next example.

Let’s create a controller which has a header property called token:

@RestController
@RequestMapping(value = "/request-header-test")
public class MaxHttpHeaderSizeController {
    @GetMapping
    public boolean testMaxHTTPHeaderSize(@RequestHeader(value = "token") String token) {
	return true;
    }
}

Next, let’s add some properties to our application.properties file:

## Server connections configuration
server.tomcat.threads.max=200
server.connection-timeout=5s
server.max-http-request-header-size=8KB
server.tomcat.max-swallow-size=2MB
server.tomcat.max-http-post-size=2MB

When we pass a String value that has a size greater than 8kb in the token, we’ll get the 400 error as below:

And in the log, we see the below error:

19:41:50.757 [http-nio-8080-exec-7] INFO  o.a.coyote.http11.Http11Processor - Error parsing HTTP request header
 Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.
java.lang.IllegalArgumentException: Request header is too large
...

4. Solution

We can increase the value of the max-http-request-header-size property in our application.properties file as per our requirements.

In the above program, we can upgrade its value from the default 8kb to 40KB, which will resolve the problem.

server.max-http-request-header-size=40KB

Now, the server will process the request and send back a 200 response as below:

Hence, whenever the header size exceeds the default values listed by the server, we’ll see the server returns a 400-Bad Request with an error “request header is too large”. We have to override the max-http-request-header-size value in the application configuration file to match the request header length, as we see in the above example.

In general, a request header might become too large when for example, the token used is very long due to encryption.

5. Conclusion

In this tutorial, we’ve learned how to use the max-http-request-header-size property in the application configuration files of our Spring Boot application.

Then, we saw what happens when we pass a request header exceeding this size and how to increase the size of max-http-request-header-size in our application.properties.

The code backing this article is available on GitHub. Once you're logged in as a Baeldung Pro Member, start learning and coding on the project.