Skip to content

Particular requests fail with HTTP/413 due to darkhttpd's 4k request limit #602

Closed

Description

@c42-konstantin

Description

CozyStack uses darkhttpd in 'cozystack' deployment itself. The problem is that https requests with OIDC authentication cookies can fail with a 413 error if the total HTTP request length exceeds 4 KB. This happens because darkhttpd has a hardcoded #define MAX_REQUEST_LENGTH 4000 (ref. darkhttpd.c#L312):

#define MAX_REQUEST_LENGTH 4000
...
if (conn->request_length > MAX_REQUEST_LENGTH) {
    default_reply(conn, 413, "Request Entity Too Large",
                  "Your request was dropped because it was too long.");
    conn->state = SEND_HEADER;
}

When OIDC against keycloak is enabled configurations, the browser sends quite large cookies (e.g., _oauth2_proxy_0 and _oauth2_proxy_1), pushing the total request size above 4 KB. Darkhttpd rejects these requests with the 413:

Example failing URLs
https://dashboard.[domain]/logos/mariadb.svg
https://dashboard.[domain]/logos/monitoring.svg
https://dashboard.[domain]/logos/ingress-nginx.svg

and they fails with:

Request Entity Too Large
Your request was dropped because it was too long.

Steps to Reproduce

  1. Deploy CozyStack 0.23.1 in an environment that uses OIDC or another authentication/authorization mechanism generating large cookies.
  2. Login to the CozyStack dashboard.
  3. Check the browser developer logs for the responses for requests that are served by the darkhttpd

Environment

cozystack image: ghcr.io/aenix-io/cozystack/cozystack:v0.23.1
platform: ghcr.io/aenix-io/cozystack/talos:v1.9.2

Possible workarounds

  1. Build customized darkhttpd with less strict limitation on the request size (though I'm not sure it's a good idea due to probably there might be some implications related to the c language and memory management etc.).
  2. Deploy some kind of an intermediate reverse proxy that will handle the authentication/authorization and strip cookies.
  3. Suggest to make MAX_REQUEST_LENGTH configurable via cmdline.

Activity

  1. added
    kind/bugCategorizes issue or PR as related to a bug
    on Jan 23, 2025
  2. kvaps commented on Jan 23, 2025

    @kvaps
    Member

    Thank you for report, this should be fixed by #596 in the next release

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/bugCategorizes issue or PR as related to a bug

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions