Skip to content

[ORCA-77] Increase max header size #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
clintonium-119 wants to merge 4 commits into from
Closed

[ORCA-77] Increase max header size #8

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
21ad03d
fix: raise the HTTP request header limit to 32 KB
clintonium-119 Jul 28, 2026
1ae5713
Remove unnecessary comment
clintonium-119 Jul 28, 2026
8adf85c
Merge branch 'release-v1.0.4' into ORCA-77-increase-max-header-size
clintonium-119 Jul 28, 2026
85113ba
Merge branch 'release-v1.0.4' into ORCA-77-increase-max-header-size
clintonium-119 Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion server.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
import { createServer } from 'node:http';
import { createRequestHandler } from '@react-router/express';
import express from 'express';

Expand Down Expand Up @@ -45,4 +46,8 @@ const port = 3000;
const host =
process.env.NODE_ENV === 'production' ? 'http://0.0.0.0' : 'http://localhost';

app.listen(port, () => console.log(host + ':' + port));
const maxHeaderSize = Number(process.env.MAX_HTTP_HEADER_SIZE) || 32768;

@coderabbitai coderabbitai Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

Resolve the ESLint process error.

The provided ESLint analysis reports process as undefined on this new line, so the repository lint command will fail. Configure Node globals for server.mjs in the ESLint configuration rather than suppressing the rule.

🧰 Tools
🪛 ESLint

[error] 49-49: 'process' is not defined.

(no-undef)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server.mjs` at line 49, Configure the ESLint environment for Node.js in the
repository’s ESLint configuration so the global process used by server.mjs is
recognized. Update the relevant ESLint settings without suppressing the
undefined-variable rule or changing maxHeaderSize.

Source: Linters/SAST tools

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

node --input-type=module <<'NODE'
import { createServer } from 'node:http';

for (const maxHeaderSize of [-1, 32768.5, 32768]) {
  try {
    createServer({ maxHeaderSize });
    console.log(maxHeaderSize, 'accepted');
  } catch (error) {
    console.log(maxHeaderSize, error.code ?? error.name);
  }
}
NODE

Repository: tidepool-org/orca-remix

Length of output: 384

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Locate and inspect server.mjs around the reported line.
if [ -f server.mjs ]; then
  sed -n '1,90p' server.mjs | nl -ba
else
  echo "server.mjs not found"
fi

# Probe Node's maxHeaderSize behavior for the exact env-related values and edge cases.
printf '\n--- Node createServer createServerOptions.maxHeaderSize behavior ---\n'
node --input-type=module <<'NODE'
import { createServer } from 'node:http';

const cases = [
  '-1',
  '32768.5',
  '0',
  '1',
  '32768',
  'not-a-number',
  '',
  'Infinity',
  '-Infinity',
  '1.0',
  '1.1',
];

for (const raw of cases) {
  const configured = Number(raw);
  const maxHeaderSize = configured || 32768;
  try {
    const server = createServer({ maxHeaderSize });
    server.close(() => console.log(`'${raw}' -> configured=${configured}, fallback=${maxHeaderSize}, accepted`));
  } catch (error) {
    console.log(`'${raw}' -> configured=${configured}, fallback=${maxHeaderSize}, rejected ${error.code ?? error.name}: ${error.message}`);
  }
}
NODE

Repository: tidepool-org/orca-remix

Length of output: 201

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "PWD=$(pwd)"
echo "server.mjs exists=$(if [ -f server.mjs ]; then echo yes; else echo no; fi)"

# Locate and inspect server.mjs around the reported line.
if [ -f server.mjs ]; then
  sed -n '1,100p' server.mjs
fi

echo
echo "--- Node createServer createServerOptions.maxHeaderSize behavior ---"
node --input-type=module <<'NODE'
import { createServer } from 'node:http';

const cases = [
  '-1',
  '32768.5',
  '0',
  '1',
  '32768',
  'not-a-number',
  '',
  'Infinity',
  '-Infinity',
  '1.0',
  '1.1',
];

for (const raw of cases) {
  const configured = Number(raw);
  const maxHeaderSize = configured || 32768;
  try {
    const server = createServer({ maxHeaderSize });
    server.close(() => console.log(`'${raw}' -> configured=${configured}, fallback=${maxHeaderSize}, accepted`));
  } catch (error) {
    console.log(`'${raw}' -> configured=${configured}, fallback=${maxHeaderSize}, rejected ${error.code ?? error.name}: ${error.message}`);
  }
}
NODE

Repository: tidepool-org/orca-remix

Length of output: 2793

Validate MAX_HTTP_HEADER_SIZE before passing it to Node.

Number(...) || 32768 lets invalid truthy values like -1, 32768.5, or Infinity reach createServer({ maxHeaderSize }), where Node rejects them as out-of-range and prevents the server from starting. Reject invalid values explicitly or fall back to the default.

🧰 Tools
🪛 ESLint

[error] 49-49: 'process' is not defined.

(no-undef)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server.mjs` at line 49, Update the maxHeaderSize configuration to validate
MAX_HTTP_HEADER_SIZE before passing it to createServer: accept only finite,
valid integer values within Node’s supported range, and fall back to 32768 or
explicitly reject invalid input. Ensure values such as -1, 32768.5, and Infinity
cannot reach createServer.


createServer({ maxHeaderSize }, app).listen(port, () =>
console.log(host + ':' + port),
);