Make header size configurable

Author: sedkis

config/config.go

@@ -534,6 +534,13 @@ type HttpServerOptionsConfig struct {
 	// See more information about setting request size limits here:
 	// https://tyk.io/docs/api-management/traffic-transformation/#request-size-limits
 	MaxRequestBodySize int64 `json:"max_request_body_size"`
+
+	// MaxHeaderBytes configures a maximum size limit for request header size (in bytes) for all APIs on the Gateway.
+	//
+	// Tyk Gateway will evaluate all API requests against this size limit and will respond with HTTP 431 status code if the header of the request is larger.
+	//
+	// Unset value, or a value of zero (default), means will use the Golang HTTP default value of 1 MB.
+	MaxHeaderBytes int `json:"max_header_bytes"`
 }
 
 type AuthOverrideConf struct {

gateway/proxy_muxer.go

@@ -465,6 +465,7 @@ func (m *proxyMux) serve(gw *Gateway) {
 				ReadTimeout:  readTimeout,
 				WriteTimeout: writeTimeout,
 				Handler:      handler,
+				MaxHeaderBytes: conf.HttpServerOptions.MaxHeaderBytes,
 			}
 			if gw.ConnectionWatcher != nil {
 				p.httpServer.ConnState = gw.ConnectionWatcher.OnStateChange

gateway/reverse_proxy.go

@@ -220,7 +220,7 @@ func (gw *Gateway) TykNewSingleHostReverseProxy(target *url.URL, spec *APISpec,
 			Handler:        http.HandlerFunc(handler),
 			ReadTimeout:    1 * time.Second,
 			WriteTimeout:   1 * time.Second,
-			MaxHeaderBytes: 1 << 20,
+			MaxHeaderBytes: spec.GlobalConfig.HttpServerOptions.MaxHeaderBytes,
 		}
 		allHostsDownURL = "http://" + listener.Addr().String()
 		go func() {