http: increase default header size from 8KB to 16KB

Fixes: #27645

PR-URL: #32520
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: David Carlier <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Jiawen Geng <[email protected]>

Author: rosaxxny

doc/api/cli.md

@@ -440,9 +440,13 @@ disappear in a non-semver-major release.
 ### `--max-http-header-size=size`
 <!-- YAML
 added: v11.6.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/32520
+    description: Change maximum default size of HTTP headers from 8KB to 16KB.
 -->
 
-Specify the maximum size, in bytes, of HTTP headers. Defaults to 8KB.
+Specify the maximum size, in bytes, of HTTP headers. Defaults to 16KB.
 
 ### `--napi-modules`
 <!-- YAML

doc/api/http.md

@@ -2059,7 +2059,7 @@ changes:
   * `maxHeaderSize` {number} Optionally overrides the value of
     [`--max-http-header-size`][] for requests received by this server, i.e.
     the maximum length of request headers in bytes.
-    **Default:** 8192 (8KB).
+    **Default:** 16384 (16KB).
 * `requestListener` {Function}
 
 * Returns: {http.Server}
@@ -2213,7 +2213,7 @@ changes:
   * `maxHeaderSize` {number} Optionally overrides the value of
     [`--max-http-header-size`][] for requests received from the server, i.e.
     the maximum length of response headers in bytes.
-    **Default:** 8192 (8KB).
+    **Default:** 16384 (16KB).
   * `method` {string} A string specifying the HTTP request method. **Default:**
     `'GET'`.
   * `path` {string} Request path. Should include query string if any.

doc/node.1

@@ -244,7 +244,7 @@ This flag is inherited from V8 and is subject to change upstream. It may
 disappear in a non-semver-major release.
 .
 .It Fl -max-http-header-size Ns = Ns Ar size
-Specify the maximum size of HTTP headers in bytes. Defaults to 8KB.
+Specify the maximum size of HTTP headers in bytes. Defaults to 16KB.
 .
 .It Fl -napi-modules
 This option is a no-op.

src/node_options.cc

@@ -422,7 +422,7 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             &EnvironmentOptions::heap_prof_interval);
 #endif  // HAVE_INSPECTOR
   AddOption("--max-http-header-size",
-            "set the maximum size of HTTP headers (default: 8192 (8KB))",
+            "set the maximum size of HTTP headers (default: 16384 (16KB))",
             &EnvironmentOptions::max_http_header_size,
             kAllowedInEnvironment);
   AddOption("--redirect-warnings",

src/node_options.h

@@ -116,7 +116,7 @@ class EnvironmentOptions : public Options {
   bool expose_internals = false;
   bool frozen_intrinsics = false;
   std::string heap_snapshot_signal;
-  uint64_t max_http_header_size = 8 * 1024;
+  uint64_t max_http_header_size = 16 * 1024;
   bool no_deprecation = false;
   bool no_force_async_hooks_checks = false;
   bool no_warnings = false;

test/parallel/test-http-max-header-size.js

@@ -5,7 +5,7 @@ const assert = require('assert');
 const { spawnSync } = require('child_process');
 const http = require('http');
 
-assert.strictEqual(http.maxHeaderSize, 8 * 1024);
+assert.strictEqual(http.maxHeaderSize, 16 * 1024);
 const child = spawnSync(process.execPath, ['--max-http-header-size=10', '-p',
                                            'http.maxHeaderSize']);
 assert.strictEqual(+child.stdout.toString().trim(), 10);

test/parallel/test-http-max-http-headers.js

@@ -4,14 +4,14 @@ const common = require('../common');
 const assert = require('assert');
 const http = require('http');
 const net = require('net');
-const MAX = +(process.argv[2] || 8 * 1024); // Command line option, or 8KB.
+const MAX = +(process.argv[2] || 16 * 1024); // Command line option, or 16KB.
 
 const { getOptionValue } = require('internal/options');
 
 console.log('pid is', process.pid);
 console.log('max header size is', getOptionValue('--max-http-header-size'));
 
-// Verify that we cannot receive more than 8KB of headers.
+// Verify that we cannot receive more than 16KB of headers.
 
 function once(cb) {
   let called = false;