setRequestHeaderSize no longer works after upgrading from 3.7.0 to 3.10.0 with Jetty

[KleyvertDevelop]

Hi everyone,

I'm currently working on a project using Jooby with the Jetty server. I recently upgraded the Jooby version from 3.7.0 to 3.10.0, and after the upgrade, the setRequestHeaderSize setting from the HttpConfiguration class seems to no longer take effect.

This is causing a significant issue in our application, as we rely on increasing the request header size limit beyond the default 8KB. In previous versions, we were able to configure this successfully, but now the setting appears to be ignored.

Is there a new or recommended way to configure the request header size in Jooby 3.10.0 when using Jetty?

Any help or guidance would be greatly appreciated. Thank you in advance!

Best regards,
Kleyvert Martínez.

[jknack]

How did you set it up?

This test passed:

@ServerTest
  public void checkJettyRequestHeaderSize(ServerTestRunner runner) {
    runner.server(server -> {
          if (server instanceof JettyServer jettyServer) {
            jettyServer.configure(http -> {
              http.setRequestHeaderSize(8192 * 2);
            });
          }
        })
        .define(app -> {
          app.get("/3721", ctx -> {
            return ctx.header("large").value();
          });
        }).ready(http -> {
          var large = ".".repeat(8192 + 1024);
          http.header("large", large);
          http.get("/3721", rsp -> {
            var result = rsp.body().string();
            assertEquals(large, result);
            assertEquals(8192 + 1024, result.length());
          });
        });
  }

[KleyvertDevelop]

Hi @jknack

This Java code defines a Router class that extends the Jooby framework and configures a Jetty server. Upon class loading, it initializes configuration management, and in an instance block, it registers a Jetty server. The registerJettyServer method creates a configuration manager, retrieves optional maximum header sizes for requests and responses (defaulting to 16384 bytes if not specified), and applies these settings to the Jetty server, which is then installed into the application. This setup worked correctly in Jooby version 3.7.0, but it no longer works as expected in version 3.10.0.

public class Router extends Jooby {

  static {
    ConfigurationManagement.init();
  }

  {
    registerJettyServer();
  }

private void registerJettyServer() {

    var configurationManager = ConfigurationManagerBuilder.builder().build();
    var facetedConfiguration = new DefaultFacetedConfiguration(configurationManager);
    int requestMaxHeaderSize = facetedConfiguration
            .getRequestMaxHeaderSize()
            .orElse(REQUEST_MAX_HEADER_SIZE_BY_DEFAULT); // 16384
    int responseMaxHeaderSize = facetedConfiguration
            .getResponseMaxHeaderSize()
            .orElse(RESPONSE_MAX_HEADER_SIZE_BY_DEFAULT); // 16384

    final JettyServer jetty = new JettyServer();
    jetty.configure(httpConfiguration -> {
      httpConfiguration.setRequestHeaderSize(requestMaxHeaderSize);
      httpConfiguration.setResponseHeaderSize(responseMaxHeaderSize);
    });

   install(jetty);
  }
}

[jknack]

@KleyvertDevelop here is the test: https://github.com/jooby-project/jooby/blob/3.x/tests/src/test/java/io/jooby/i3721/Issue3721.java#L20-L43

it does the same, just I added the built-in support for request header size

[KleyvertDevelop]

Hi @jknack

While debugging the application with Jooby version 3.10.0, I noticed that the code inside the configure method of the JettyServer instance is not being executed:

httpConfiguration -> {
  log.error("request Max header size: {}", requestMaxHeaderSize);
  httpConfiguration.setRequestHeaderSize(requestMaxHeaderSize);
  httpConfiguration.setResponseHeaderSize(responseMaxHeaderSize);
}

final JettyServer jetty = new JettyServer();
    jetty.configure(httpConfiguration -> {
      log.error("request Max header size: {}", requestMaxHeaderSize);
      httpConfiguration.setRequestHeaderSize(requestMaxHeaderSize);
      httpConfiguration.setResponseHeaderSize(responseMaxHeaderSize);
    });

This was working fine in version 3.7.0, but in 3.10.0, the block doesn't seem to run at all.

[jknack]

It is side effect of #3645.

The install(Server) won't work anymore. I need to removed/deprecate that option. Try this:

public static void main(String[] args) {
    var configurationManager = ConfigurationManagerBuilder.builder().build();
    var facetedConfiguration = new DefaultFacetedConfiguration(configurationManager);
    int requestMaxHeaderSize = facetedConfiguration
            .getRequestMaxHeaderSize()
            .orElse(REQUEST_MAX_HEADER_SIZE_BY_DEFAULT); // 16384
    int responseMaxHeaderSize = facetedConfiguration
            .getResponseMaxHeaderSize()
            .orElse(RESPONSE_MAX_HEADER_SIZE_BY_DEFAULT); // 16384

    final JettyServer jetty = new JettyServer();
    jetty.configure(httpConfiguration -> {
      httpConfiguration.setRequestHeaderSize(requestMaxHeaderSize);
      httpConfiguration.setResponseHeaderSize(responseMaxHeaderSize);
    });

   runApp(args, jetty, List.of(Myapp::new));
  }

}

[KleyvertDevelop]

Hi @jknack,

Thank you so much — your solution using runApp(args, jetty, List.of(MyApp::new)); worked perfectly. I was able to modify the requestHeaderSize successfully!

One last question: in our case, we needed to increase the requestHeaderSize because another application is sending very large headers. However, after switching to a custom JettyServer instance, we’ve noticed issues with traceability — some headers are getting lost.

We’re not sure yet whether the problem is caused by the large header size itself or if something is missing from the default configuration when we create a new JettyServer instance manually. It seems that certain tracing headers might not be passed through correctly, and we're investigating whether this is due to missing middleware or filters that were previously configured automatically.

[jknack]

There is no difference between doing new JettyServer() or loading automatically from service provider. Is this issue in 3.10.0?