Header/Body size limits in APIcast

Solution Verified - Updated -

Environment

  • Red Hat 3scale API Management
    • 2.15 (On Premise)
  • SaaS

Issue

  • Do APIcast body and header size limits have the same default values ​​as Nginx/OpenResty?
  • What are the default values of APIcast body and header size limits?
  • Are APIcast body and header size limits configurable?

Resolution

APIcast's default size limits for Request/Response header and body can be summarized as follows:

Request Size Limits

Headers:

Client request headers are subject to the Nginx default, that is 1 KB as per the Nginx client request header documentation.

For large client request headers, the size limit can be up to 32 KB (configured as four 8 KB buffers).

From Red Hat 3scale API Management 2.15 version onwards, APIcast's large client request header limit can be set by configuring the APICAST_LARGE_CLIENT_HEADER_BUFFERS variable.

Body:

The default Nginx/OpenResty configuration represents a maximum body size of 1 MB. However, in APIcast this parameter is set to 0, here, and hence, the checking of the client request body size is disabled and so there is no request body limit configured.

Response Size Limits

Headers:

The default Nginx/OpenResty limit for response header is equal to one memory page. This is either 4 KB or 8 KB. This default value effectively applies for APIcast's response header size limit.

Body:

There is no explicit response body size limit defined. However, from a practical perspective, it is recommended to keep response sizes to within a few megabytes. Also, by using the Response/Request Content Limits APIcast policy the response body size could be limited if needed.

Disclaimer: Links contained herein to external website(s) are provided for convenience only. Red Hat has not reviewed the links and is not responsible for the content or its availability. The inclusion of any link to an external website does not imply endorsement by Red Hat of the website or their entities, products or services. You agree that Red Hat is not responsible or liable for any loss or expenses that may result due to your use of (or reliance on) the external site or content.

Root Cause

  • APIcast is built on top of Nginx/OpenResty, hence all default values ​​for request/response size limits also apply to the APIcast gateway.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments