Skip to content

Verify and implement the NGINX 8 KiB header line limit - #3574

Merged
adamtheturtle merged 2 commits into
mainfrom
adamtheturtle/fix-issue-3571
Sep 8, 2026
Merged

Verify and implement the NGINX 8 KiB header line limit#3574
adamtheturtle merged 2 commits into
mainfrom
adamtheturtle/fix-issue-3571

Conversation

@adamtheturtle

@adamtheturtle adamtheturtle commented Sep 8, 2026

Copy link
Copy Markdown
Member

Closes #3571.

What was verified

Signed requests were sent to real Vuforia on 2026-09-08 with a single header, and with a cookie, of various sizes.

Host Header line Result
vws.vuforia.com (GET /summary) 8190 bytes 200
vws.vuforia.com 8191 bytes 400 NGINX "Request Header Or Cookie Too Large", served with Envoy headers
vws.vuforia.com 16384 bytes and up 400 from the AWS load balancer (Server: awselb/2.0), shorter body
vws.vuforia.com Cookie line 8193 bytes 200 (Envoy lets cookies slightly over through); 8300 bytes gives the NGINX 400
cloudreco.vuforia.com (POST /v1/query) 7500 bytes 200
cloudreco.vuforia.com 8000 to 8190 bytes 431 HTML from Jetty (total header size)
cloudreco.vuforia.com 8191 bytes and up, header or cookie 400 NGINX, served with Server: nginx

The documented "8 KiB" limit is real: NGINX rejects any header line which, with its CRLF, does not fit an 8192-byte buffer.

Changes

  • The mock returns the NGINX 400 response for any header line longer than 8190 bytes on both the Target API and the Query API, checked before any other validation (including authorization).
  • tests/mock_vws/test_header_size.py covers an over-long header, an over-long cookie and a large header within the limit, against every backend. All 33 real-Vuforia cases pass locally.
  • The differences document records the observed behaviour and the related cases the mock does not model (Envoy cookie allowance, load balancer 16 KiB limit, Query API 431). The never-attempted entry is removed from unverified-behavior.rst.
  • New CI matrix entries for the three tests.

Note for probing in future: GET /targets has a one-per-minute limit, and its Envoy 429s initially made the results look non-deterministic. GET /summary gives clean results.

🤖 Generated with Claude Code

@adamtheturtle @claude
Verify and implement the NGINX 8 KiB header line limit
24a0143 
Observed against real Vuforia on 2026-09-08: both the Target API and
the Query API return NGINX's "400 Request Header Or Cookie Too Large"
HTML response for any header line of 8191 bytes or more, and accept a
line of 8190 bytes. The mock now does the same, checked before any
other validation, and a test runs the cases against every backend.

The related behaviors which were observed but are not implemented (an
Envoy cookie allowance, the AWS load balancer's 16 KiB limit and the
Query API application server's 431) are recorded in the differences
document, and the never-attempted entry is removed.

Closes #3571

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@adamtheturtle @claude
Retry the concrete requests timeout and connection errors in CI
40154ea 
pytest-retry checks whether the failing exception's type is in the
filtered tuple, so a subclass of a listed type is never retried. The
tuple listed requests' Timeout, but requests raises ReadTimeout and
ConnectTimeout, so a TLS handshake timeout against real Vuforia failed
a job outright instead of being retried. List the concrete types, and
requests' ConnectionError, explicitly.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Verify the NGINX 8 KiB header limit against real Vuforia

1 participant

@adamtheturtle