The security team at my company has set a limit on the number of headers a HTTP request can contain (not header size, but an actual hard count limit on the number of headers).
A vendor has added a few headers for request tracing purposes, which has meant some requests are being denied as they exceed this limit.
I can understand why we would add a limit of say 500 headers, or perhaps even 100. But the limit we have set is more like 25 headers.
When we ask why this limit is in place the answer is just "security".
Is there an actual reason as to why you would want such a low limit? I can understand size limits, but not this.