From ffa642e47231678c6dc24749531e5abfbfa1cf50 Mon Sep 17 00:00:00 2001
From: Pedro Sousa <680496+pedrosousa@users.noreply.github.com>
Date: Thu, 3 Apr 2025 12:02:04 +0100
Subject: [PATCH] [Ruleset Engine] Update request header fields

---
 src/content/fields/index.yaml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/content/fields/index.yaml b/src/content/fields/index.yaml
index cd8e974f332f4a..f19bab6de0a139 100644
--- a/src/content/fields/index.yaml
+++ b/src/content/fields/index.yaml
@@ -1517,6 +1517,8 @@ entries:
       - **Decoding**: No decoding performed
       - **Whitespace**: Preserved
       - **Non-ASCII**: Preserved
+
+      When the HTTP request contains too many headers, this field may not contain all of the headers sent in the HTTP request. In this situation, the [`http.request.headers.truncated`](/ruleset-engine/rules-language/fields/reference/http.request.headers.truncated/) field will be set to `true`.
     example_value: |-
       {"content-type": ["application/json"]}
     example_block: |-
@@ -1538,6 +1540,8 @@ entries:
       - **Whitespace**: Preserved
       - **Non-ASCII**: Preserved
 
+      When the HTTP request contains too many headers, this field may not contain the names of all of the headers sent in the HTTP request. In this situation, the [`http.request.headers.truncated`](/ruleset-engine/rules-language/fields/reference/http.request.headers.truncated/) field will be set to `true`.
+
       **Note**: In HTTP/2, the names of HTTP headers are always in lowercase. Recent versions of the `curl` tool [enable HTTP/2 by default](https://curl.se/docs/manpage.html#--http2) for HTTPS connections.
     example_value: |-
       ["content-type"]
@@ -1560,6 +1564,8 @@ entries:
       - **Whitespace**: Preserved
       - **Non-ASCII**: Preserved
 
+      When the HTTP request contains too many headers, this field may not contain the values of all of the headers sent in the HTTP request. In this situation, the [`http.request.headers.truncated`](/ruleset-engine/rules-language/fields/reference/http.request.headers.truncated/) field will be set to `true`.
+
       **Note**: In HTTP/2, the names of HTTP headers are always in lowercase. Recent versions of the `curl` tool [enable HTTP/2 by default](https://curl.se/docs/manpage.html#--http2) for HTTPS connections.
     example_value: |-
       Example 1: ["application/json"]
@@ -1578,7 +1584,7 @@ entries:
     keywords: [request, client, visitor]
     summary: Indicates whether the HTTP request contains too many headers.
     description: |-
-      When `true`, [`http.request.headers`](/ruleset-engine/rules-language/fields/reference/http.request.headers), [`http.request.headers.names`](/ruleset-engine/rules-language/fields/reference/http.request.headers.names), and [`http.request.headers.values`](/ruleset-engine/rules-language/fields/reference/http.request.headers.values) may not contain all of the headers sent in the HTTP request.
+      When `true`, [`http.request.headers`](/ruleset-engine/rules-language/fields/reference/http.request.headers/), [`http.request.headers.names`](/ruleset-engine/rules-language/fields/reference/http.request.headers.names/), and [`http.request.headers.values`](/ruleset-engine/rules-language/fields/reference/http.request.headers.values/) may not contain all of the headers sent in the HTTP request.
 
   - name: http.request.accepted_languages
     data_type: Array<String>