Configure http header size and limit

[smyrick]

Is your feature request related to a problem? Please describe.

In NodeJS, which also means Apollo Gateway, I can set the max HTTP header size and limit (see --max-http-header-size). Apollo Router under the hood uses Hyper which also has some options to configure those limits but I do not have access to them in Router user space or configuration so we are stuck with the defaults of the underlying engine

Describe the solution you'd like

I would like to be able to configure the max http header size and limits from either the command line or YAML

server: # maybe some new top level section for just HTTP server stuff?
  http_header_size: 32kb
  http_header_limit: 250

Note: This would probably also be a better place for http_max_request_bytes

Describe alternatives you've considered

If I wanted to set the limits to a lower value I could implement a Rhai or Coprocessor to check the HTTP request info but if I wanted to go higher, like 32kb, then I cannot as the default is set to 16kb as controlled by Hyper.

[abernix]

would probably also be a better place for http_max_request_bytes

Agree, however today, maybe we can just use limits for this and re-visit in the future with a holistic consideration of the YAML configuration. Today, limits is all about "request" related stuff coming into the router from the client, but a server section might be more clear in the future.

[dcook-hsi]

It would be helpful if a new http1_max_request_headers_size configuration was added to limits to allow for changing the default header size. The absence of this configuration is causing my team to set up additional infrastructure and make additional HTTP calls to get around it.

[abernix]

@dcook-hsi have you considered making a contribution request to the router for this rather than setting up the additional infrastructure?

[smyrick]

@dcook-hsi I am by no means a rust developer, but using Copilot I started a PR here: https://github.com/apollographql/router/pull/8269

Does this help your team with the features? If there is something missing with would be helpful to commit them to the PR

[dcook-hsi]

@smyrick There are no Rust developers at my organization but I can attempt to build this branch locally to see if it resolves the issue. I wouldn't know enough to be able to fix the PR if it doesn't work but maybe AI would.

Thanks for generating the PR!

[dcook-hsi]

@smyrick I was able to verify that the PR allows the header size to be configured. The settings are different than what is listed in the comments in the PR though. These are the new settings in the PR for anyone who comes across this thread:

limit:
  http_max_header_size: "5kb"    # max size for any individual header
  http_max_header_list_size: "20kb"    # max size of all headers combined

From my tests, it looks like http_max_header_size works as expected but http_max_header_list_size doesn't do anything.