Skip to content

Commit 95c94f5

Browse files
Copilotgewarren
andcommitted
Add Uri length limits breaking change documentation for .NET 10 Preview 7
Co-authored-by: gewarren <[email protected]>
1 parent 70190d3 commit 95c94f5

File tree

2 files changed

+59
-0
lines changed

2 files changed

+59
-0
lines changed

docs/core/compatibility/10.0.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,7 @@ If you're migrating an app to .NET 10, the breaking changes listed here might af
8585
| [HTTP/3 support disabled by default with PublishTrimmed](networking/10.0/http3-disabled-with-publishtrimmed.md) | Source incompatible | Preview 6 |
8686
| [HttpClient/SslStream default certificate revocation check mode changed to Online](networking/10.0/ssl-certificate-revocation-check-default.md) | Behavioral change | Preview 6 |
8787
| [Streaming HTTP responses enabled by default in browser HTTP clients](networking/10.0/default-http-streaming.md) | Behavioral change | Preview 3 |
88+
| [Uri length limits have been removed](networking/10.0/uri-length-limits-removed.md) | Behavioral change | Preview 7 |
8889

8990
## SDK and MSBuild
9091

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
title: "Breaking change: Uri length limits have been removed"
3+
description: "Learn about the .NET 10 breaking change in networking where Uri length limits of around 65k characters have been removed."
4+
ms.date: 12/13/2024
5+
ai-usage: ai-assisted
6+
---
7+
8+
# Uri length limits have been removed
9+
10+
Methods that create <xref:System.Uri> instances (constructors and `TryCreate` factory methods) have historically limited the length of the Uri string to around 65k characters (exact limits varied slightly depending on the input format). As of .NET 10 preview 7, these limits have been lifted such that there is practically no upper bound on how long `Uri`s can be.
11+
12+
## Version introduced
13+
14+
.NET 10 Preview 7
15+
16+
## Previous behavior
17+
18+
It was previously not possible to create a <xref:System.Uri> instance whose length exceeded around 65k characters. Code like the following example previously threw a <xref:System.UriFormatException> with the message "Invalid URI: The Uri string is too long."
19+
20+
```csharp
21+
new Uri($"https://host/{new string('a', 100_000)}")
22+
```
23+
24+
## New behavior
25+
26+
<xref:System.Uri> instances containing large amounts of data can now be created. For example:
27+
28+
```csharp
29+
string largeQuery = ...;
30+
return new Uri($"https://someService/?query={Uri.EscapeDataString(largeQuery)}");
31+
```
32+
33+
The removed restrictions mainly apply to paths, queries, and fragments as the most practical components to carry large amounts of data. Components such as the scheme and host might still enforce some length limits. Practical limitations as you approach the length limits of `string` also apply, so you may not (nor should you) use <xref:System.Uri> to represent a 10 GB file.
34+
35+
## Type of breaking change
36+
37+
This change is a [behavioral change](../../categories.md#behavioral-change).
38+
39+
## Reason for change
40+
41+
Most HTTP servers enforce strict length restrictions on URLs they are willing to accept in requests, generally much lower than <xref:System.Uri>'s existing limits. However, since <xref:System.Uri> is the de facto exchange type in .NET for Uri-like information, the previous limits limited its use in some scenarios without good workarounds aside from removing the use of <xref:System.Uri> throughout API contracts.
42+
43+
Main scenarios for large <xref:System.Uri> are:
44+
45+
- `data:` uris, which contain arbitrary binary blobs encoded in Base64. These might be transmitted outside of the HTTP request line, for example, they might be part of the request body, and can therefore be arbitrarily large. <xref:System.Uri> might now be used to represent data Uris containing larger files.
46+
- Large query strings. <xref:System.Uri> is often used as an exchange type between systems even if it will never be sent as part of an HTTP request. User request information is often encoded as part of the query string, so the new behavior enables such scenarios even as the amount of data grows.
47+
48+
## Recommended action
49+
50+
For the majority of users, there is no action required.
51+
52+
If you are relying on <xref:System.Uri> imposing such length restrictions as part of your input validation, you must now perform length checking yourself, preferably as a step before you construct the <xref:System.Uri> instance. As most HTTP servers are enforcing much stricter length limits in practice, very long inputs were already likely to result in failures when sent as part of an HTTP request. You might find that your scenario would benefit from performing even stricter length validation than <xref:System.Uri> had done previously.
53+
54+
## Affected APIs
55+
56+
- All <xref:System.Uri> constructors
57+
- All <xref:System.Uri.TryCreate*?displayProperty=nameWithType> overloads
58+
- By extension also all <xref:System.Uri> members that return information about the <xref:System.Uri> instance, such as <xref:System.Uri.AbsolutePath?displayProperty=nameWithType>, <xref:System.Uri.AbsoluteUri?displayProperty=nameWithType>, <xref:System.Uri.PathAndQuery?displayProperty=nameWithType>, and others

0 commit comments

Comments
 (0)