https://kdev.ing/assets/posts_request-header-is-too-large.md.CWTmgVSB.js

1import{B as e,et as t,mt as n,tt as r}from"./chunks/framework.Bgbhl1zx.js";var i=JSON.parse(`{"title":"Request Header is Too Large","description":"","frontmatter":{"title":"Request Header is Too Large","date":"2024-03-26T23:00+09:00","tags":["HTTP","Spring Boot","웹 서버"]},"headers":[],"relativePath":"posts/request-header-is-too-large.md","filePath":"posts/request-header-is-too-large.md","lastUpdated":1791240792000}`),a={name:`posts/request-header-is-too-large.md`};function o(e,i,a,o,s,c){return n(),t(`div`,null,[...i[0]||=[r(`<blockquote><p>java.lang.IllegalArgumentException: Request header is too large</p></blockquote><div class="language-java"><button title="Copy Code" class="copy"></button><span class="lang">java</span><pre class="shiki shiki-themes github-light github-dark" style="--shiki-light:#24292e;--shiki-dark:#e1e4e8;--shiki-light-bg:#fff;--shiki-dark-bg:#24292e;" tabindex="0" dir="ltr"><code><span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">@</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">GetMapping</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">(</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;/by-ids&quot;</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">)</span></span>
2<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">List</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">&lt;</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">User</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">&gt;</span><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> getUsers</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">(@</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">RequestParam</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">(</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">name</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;"> =</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> &quot;ids&quot;</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">) </span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">String</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">[] ids) {</span></span>
3<span class="line"><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">    return</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> List.</span><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">of</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">();</span></span>
4<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">}</span></span></code></pre></div><p>위와 같은 GET API는 ids 파라미터에 대한 길이 제한을 두지 않았으므로 Request header is too large 에 대한 취약점이 내재되어있는 상태로 볼 수 있다. 그렇다면 이에 대한 문제는 어떻게 처리하는 것이 좋을까?</p><h4 id="첫번째-서버에서-처리하는-헤더-크기-사이즈를-늘리자" tabindex="-1">첫번째, 서버에서 처리하는 헤더 크기 사이즈를 늘리자 <a class="header-anchor" href="#첫번째-서버에서-처리하는-헤더-크기-사이즈를-늘리자" aria-label="Permalink to “첫번째, 서버에서 처리하는 헤더 크기 사이즈를 늘리자”">​</a></h4><p>기본적인 해결방법은 생각보다 작게 설정되어있는 헤더 크기를 어느정도 늘리는 것이다. 다만, 여전히 예상할 수 없는 헤더 크기를 커버할 수 없으며 이에 대한 대응으로는 GET 요청이 아닌 POST 요청을 활용해야한다. 요청 헤더 크기에 대한 제한을 늘리는 방안은 임시 조치임을 잊지 말자.</p><div class="language-yml"><button title="Copy Code" class="copy"></button><span class="lang">yml</span><pre class="shiki shiki-themes github-light github-dark" style="--shiki-light:#24292e;--shiki-dark:#e1e4e8;--shiki-light-bg:#fff;--shiki-dark-bg:#24292e;" tabindex="0" dir="ltr"><code><span class="line"><span style="--shiki-light:#11782a;--shiki-dark:#85E89D;">server.max-http-request-header-size</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">10MB</span></span></code></pre></div><h4 id="두번째-url-인코딩-방식의-폼-데이터를-전달하자" tabindex="-1">두번째, URL 인코딩 방식의 폼 데이터를 전달하자 <a class="header-anchor" href="#두번째-url-인코딩-방식의-폼-데이터를-전달하자" aria-label="Permalink to “두번째, URL 인코딩 방식의 폼 데이터를 전달하자”">​</a></h4><p>GET 요청 시 쿼리 파라미터가 너무 길어질 수 있다면 폼 데이터 형식으로 보낼 수 있도록 <strong>POST 요청에 대해서도 지원</strong>하면 된다.</p><div class="language-java"><button title="Copy Code" class="copy"></button><span class="lang">java</span>

4<pre class="shiki shiki-themes github-light github-dark" style="--shiki-light:#24292e;--shiki-dark:#e1e4e8;--shiki-light-bg:#fff;--shiki-dark-bg:#24292e;" tabindex="0" dir="ltr"><code><span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">@</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">GetMapping</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">(</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">path</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;"> =</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> &quot;/by-ids&quot;</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">)</span></span>
5<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">List</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">&lt;</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">User</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">&gt;</span><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> getUsers</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">(@</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">RequestParam</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">(</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">name</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;"> =</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> &quot;ids&quot;</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">) </span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">String</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">[] ids) {</span></span>
6<span class="line"><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">    return</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> List.</span><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">of</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">();</span></span>
7<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">}</span></span>
8<span class="line"></span>
9<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">@</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">PostMapping</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">(</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">path</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;"> =</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> &quot;/by-ids&quot;</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">, </span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">consumes</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;"> =</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> {MediaType.APPLICATION_FORM_URLENCODED_VALUE})</span></span>
10<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">List</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">&lt;</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">User</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">&gt;</span><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> getUsersUsingFormData</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">(@</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">RequestParam</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">(</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">name</span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;"> =</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> &quot;ids&quot;</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">) </span><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">String</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">[] ids) {</span></span>
11<span class="line"><span style="--shiki-light:#c62739;--shiki-dark:#F97583;">    return</span><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;"> getUsers</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">(ids);</span></span>
12<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">}</span></span></code></pre></div><h4 id="참고할만한-링크" tabindex="-1">참고할만한 링크 <a class="header-anchor" href="#참고할만한-링크" aria-label="Permalink to “참고할만한 링크”">​</a></h4><ul><li><a href="https://www.baeldung.com/spring-boot-max-http-header-size" target="_blank" rel="noreferrer">Max-Http-Request-Header-Size in Spring Boot</a></li><li><a href="https://www.baeldung.com/postman-form-data-raw-x-www-form-urlencoded" target="_blank" rel="noreferrer">Difference Between form-data, x-www-form-urlencoded and raw in Postman</a></li><li><a href="https://www.baeldung.com/spring-url-encoded-form-data" target="_blank" rel="noreferrer">Handling URL Encoded Form Data in Spring REST</a></li></ul>`,11)]])}var s=e(a,[[`render`,o]]);

12export{i as __pageData,s as default};