2

Title says it all: from which version onward is the LimitRequestFieldSize no longer hardcoded to a max. of 8k?

It seems 2.2.15 is still affected.

sysadmin1138
  • 131,083
  • 18
  • 173
  • 296
Michael Böckling
  • 301
  • 3
  • 15

1 Answers1

5

Ok, so it turns out that it works in 2.2, but you need to increase the max AJP packet size if you have a Tomcat behind it and use mod_proxy_ajp, or else it will still give a 400 Bad Request.

Specifically, set this in Apache:

LimitRequestFieldSize 65536
ProxyIOBufferSize 65536

and this in Tomcat server.xml on the ajp connector:

packetSize="65536"

Only setting LimitRequestFieldSize won't do the trick!

Michael Böckling
  • 301
  • 3
  • 15
  • Regarding where to set in Apache: http://serverfault.com/questions/413984/increase-the-value-of-limitrequestfieldsize-in-apache – sactiw May 05 '16 at 09:58