Error max response HTTP Header Size on httpclient

[jsanhc]

Describe the bug

• We increase the max header size to 100kb required for the large signed JWT in the Spring Cloud Gateway (Netty based) app.
• server.max-http-header-size spring docs

server:
  max-http-header-size: 10000000 # Required for the large signed JWT headers

• We write the below component:

/**
 * This is required to support the large header sizes we use when signing payment file uploads
 */
@Component
public class WebServerConfig implements WebServerFactoryCustomizer<NettyReactiveWebServerFactory> {

    @Value("${server.max-http-header-size:165536}")
    private int maxHeaderSize;

    public void customize(NettyReactiveWebServerFactory container) {
        container.addServerCustomizers(
                httpServer -> httpServer.httpRequestDecoder(
                        httpRequestDecoderSpec -> httpRequestDecoderSpec.maxHeaderSize(maxHeaderSize)
                )
        );
    }

}

• But running the functional tests some tests and such as example the test PollAndAcknowledgeAggregatedPollingTest it's raise the below error:

{
  "timestamp": "2021-02-18T15:30:35.766+0000",
  "path": "/open-banking/v3.1.6/events",
  "status": 500,
  "error": "Internal Server Error",
  "message": "HTTP header is larger than 8192 bytes."
}

To Reproduce
Steps to reproduce the behaviour:

1. run the test PollAndAcknowledgeAggregatedPollingTest against master.
2. See error

Expected behaviour
No error.

Current behaviour
Error.

Workaround

• We are using the version 2.1.1.RELEASE of spring cloud gateway.
• Upgrade spring cloud gateway to 2.15.RELEASE where seems to be fixed.
• See commit 64a579d

Code analysis

• The error it's raise because the max header size set in the configuration it's being applied only for the request httpRequestDecoderSpec and not for the response httpResponseDecoderSpec and when the httpObjectDecoder.HeaderParser#process runs with the default value max header size 8192 bytes.
• Seems a bug in spring boot cloud gateway

Release Notes

Affected App: Gateway app.

[jsanhc]

Implemented Solution

• Upgraded spring cloud version Greenwich.SR1 to Greenwich.SR6 in openbanking-parent this latest spring cloud version have the dependency version 2.1.5 of gateway-core with the fix to set the max header size as a httpClient property for responses.
• Added max-header-size property in the application.yml file in reference-implementation/openbanking-config.

#Spring cloud config
spring:
  ...
  cloud:
    ...
      ...
    gateway:
      httpclient:
        max-header-size: 10000000 # The max response header size, Required for the large signed JWT headers

Check projects openbanking-parent pom integrity after upgrade spring-cloud framework to Greenwich.SR6 to fix max header size on the response (HttpClient)

• openbanking-parent
• eidas-psd2-sdk
• openbanking-clients
• openbanking-jwkms
• openbanking-auth
• openbanking-tpp
• openbanking-analytics
• openbanking-common
• openbanking-uk-datamodel
• openbanking-directory
• openbanking-aspsp
• openbanking-reference-implementation

[svankamamidi]

Implemented Solution

• Upgraded spring cloud version Greenwich.SR1 to Greenwich.SR6 in openbanking-parent this latest spring cloud version have the dependency version 2.1.5 of gateway-core with the fix to set the max header size as a httpClient property for responses.
• Added max-header-size property in the application.yml file in reference-implementation/openbanking-config.

#Spring cloud config
spring:
  ...
  cloud:
    ...
      ...
    gateway:
      httpclient:
        max-header-size: 10000000 # The max response header size, Required for the large signed JWT headers

Check projects openbanking-parent pom integrity after upgrade spring-cloud framework to Greenwich.SR6 to fix max header size on the response (HttpClient)

• openbanking-parent
• eidas-psd2-sdk
• openbanking-clients
• openbanking-jwkms
• openbanking-auth
• openbanking-tpp
• openbanking-analytics
• openbanking-common
• openbanking-uk-datamodel
• openbanking-directory
• openbanking-aspsp
• openbanking-reference-implementation

this solution is not working for us. We are using Spring Boot 2.7.2