fix(dev): Raise dev header limit to 512K so localhost cookie bloat stops 431ing - #143
Merged
Conversation
…loat stops 431ing 128 KB was still not enough on a heavily-used dev box: `localhost` shares one cookie jar across every dev app, and a full jar overflowed both Kestrel's MaxRequestHeadersTotalSize and Keycloak's QUARKUS_HTTP_LIMITS_MAX_HEADER_SIZE mid-OIDC, giving HTTP 431 before auth — forcing an incognito window or a cookie clear on every login. Both limits go to 512 KB, kept in lockstep, so the whole round-trip survives a bloated jar in a normal browser tab. Dev/local only; cloud requests carry no such bloat, so the larger ceiling is harmless. Verified on the running stack: a 200 KB Cookie header (a hard 431 at 128 KB) now returns 302 from the Web and 200 from Keycloak. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
128K wasn't enough on a heavy dev box — a full localhost cookie jar overflowed Kestrel + Keycloak mid-OIDC → HTTP 431, forcing incognito/cookie-clear on every login. Both limits → 512K (lockstep). Dev-only; cloud unaffected.
Verified on the running stack: a 200KB Cookie header (hard 431 at 128K) now returns 302 from Web and 200 from Keycloak.
🤖 Generated with Claude Code