Maximum on HTTP header values?

Question

Is there an accepted maximum allowed size for HTTP headers? If so, what is it?

Answer 1

Hi @19sc027田中 ,
HTTP does not define any restrictions. But most web servers do limit the size of the headers they accept. Uncapped HTTP header size keeps the server exposed to attacks and can bring down its capacity to serve organic traffic. Although each web server has some limitations, there are differences. The following are some common web servers:

IIS - 8K-16K (varies by version)
Apache - 8K
Nginx - 4K-8K
Tomcat - 8K – 48K

If the header size exceeds this limit, the server will return a 413 Entity Too Large error.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the email notification for this thread.

Best regards,
Yurong Dai