{"action":"created","issue":{"url":"https://api.github.com/repos/benoitc/gunicorn/issues/976","labels_url":"https://api.github.com/repos/benoitc/gunicorn/issues/976/labels{/name}","comments_url":"https://api.github.com/repos/benoitc/gunicorn/issues/976/comments","events_url":"https://api.github.com/repos/benoitc/gunicorn/issues/976/events","html_url":"https://github.com/benoitc/gunicorn/pull/976","id":56441423,"number":976,"title":"increase hard limit for headers","user":{"login":"joycepg","id":1146340,"avatar_url":"https://avatars.githubusercontent.com/u/1146340?v=3","gravatar_id":"","url":"https://api.github.com/users/joycepg","html_url":"https://github.com/joycepg","followers_url":"https://api.github.com/users/joycepg/followers","following_url":"https://api.github.com/users/joycepg/following{/other_user}","gists_url":"https://api.github.com/users/joycepg/gists{/gist_id}","starred_url":"https://api.github.com/users/joycepg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joycepg/subscriptions","organizations_url":"https://api.github.com/users/joycepg/orgs","repos_url":"https://api.github.com/users/joycepg/repos","events_url":"https://api.github.com/users/joycepg/events{/privacy}","received_events_url":"https://api.github.com/users/joycepg/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-02-03T21:38:50Z","updated_at":"2015-02-06T22:14:06Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/benoitc/gunicorn/pulls/976","html_url":"https://github.com/benoitc/gunicorn/pull/976","diff_url":"https://github.com/benoitc/gunicorn/pull/976.diff","patch_url":"https://github.com/benoitc/gunicorn/pull/976.patch"},"body":"Kerberos tickets can be greater than 8190 bytes. This can occur when the ticket comes from Active Directory for a user who is a member of many groups. If the ticket is used as the value for the Authorization header, it will be rejected by gunicorn.\r\nAuthorization: Negotiate YIIYkAYGKwYBBQUCoIIYhDCCGICgMDAuBgkqhkiC9xIBAgIGCSqGSIb3EgECAg.....<another ~8500 bytes>\r\ncauses a 400 Bad Request, with Error parsing headers: 'limit request headers fields size'.\r\nWorkaround is to set --limit-request-field_size=0, but this disables that header checking functionality completely. \r\n\r\nI note that my solution also increases the default value. You may want to alter your code to retain 8190 as the default but allow the setting to set a value higher.\r\n\r\nAlso note that Microsoft have an IIS setting for similar reasons, and it can go to 64k max. see http://support.microsoft.com/kb/2020943"},"comment":{"url":"https://api.github.com/repos/benoitc/gunicorn/issues/comments/73322647","html_url":"https://github.com/benoitc/gunicorn/pull/976#issuecomment-73322647","issue_url":"https://api.github.com/repos/benoitc/gunicorn/issues/976","id":73322647,"user":{"login":"tilgovi","id":20818,"avatar_url":"https://avatars.githubusercontent.com/u/20818?v=3","gravatar_id":"","url":"https://api.github.com/users/tilgovi","html_url":"https://github.com/tilgovi","followers_url":"https://api.github.com/users/tilgovi/followers","following_url":"https://api.github.com/users/tilgovi/following{/other_user}","gists_url":"https://api.github.com/users/tilgovi/gists{/gist_id}","starred_url":"https://api.github.com/users/tilgovi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tilgovi/subscriptions","organizations_url":"https://api.github.com/users/tilgovi/orgs","repos_url":"https://api.github.com/users/tilgovi/repos","events_url":"https://api.github.com/users/tilgovi/events{/privacy}","received_events_url":"https://api.github.com/users/tilgovi/received_events","type":"User","site_admin":false},"created_at":"2015-02-06T22:14:06Z","updated_at":"2015-02-06T22:14:06Z","body":"I feel like maybe we shouldn't be capping user supplied configurations. Users should increase it at their own risk, no?"}}