diff --git a/core/src/main/java/io/undertow/UndertowOptions.java b/core/src/main/java/io/undertow/UndertowOptions.java index 20663ca097..b06cf46a1c 100644 --- a/core/src/main/java/io/undertow/UndertowOptions.java +++ b/core/src/main/java/io/undertow/UndertowOptions.java @@ -103,6 +103,8 @@ public class UndertowOptions { public static final Option MAX_HEADERS = Option.simple(UndertowOptions.class, "MAX_HEADERS", Integer.class); + public static final int DEFAULT_MAX_COOKIES = 200; + /** * The maximum number of cookies that will be parsed. This is used to protect against hash vulnerabilities. *

@@ -265,7 +267,7 @@ public class UndertowOptions { public static final Option HTTP2_SETTINGS_ENABLE_PUSH = Option.simple(UndertowOptions.class, "HTTP2_SETTINGS_ENABLE_PUSH", Boolean.class); /** - * The maximum number of concurrent + * The maximum number of concurrent http2 streams. */ public static final Option HTTP2_SETTINGS_MAX_CONCURRENT_STREAMS = Option.simple(UndertowOptions.class, "HTTP2_SETTINGS_MAX_CONCURRENT_STREAMS", Integer.class); diff --git a/core/src/main/java/io/undertow/protocols/http2/Http2Channel.java b/core/src/main/java/io/undertow/protocols/http2/Http2Channel.java index fa652ae36f..6e999bddef 100644 --- a/core/src/main/java/io/undertow/protocols/http2/Http2Channel.java +++ b/core/src/main/java/io/undertow/protocols/http2/Http2Channel.java @@ -121,6 +121,8 @@ public class Http2Channel extends AbstractFramedChannel requestCookies() { Set requestCookiesParam = new OverridableTreeSet<>(); requestCookies = new DelegatingIterable<>(requestCookiesParam); Cookies.parseRequestCookies( - getConnection().getUndertowOptions().get(UndertowOptions.MAX_COOKIES, 200), + getConnection().getUndertowOptions().get(UndertowOptions.MAX_COOKIES, UndertowOptions.DEFAULT_MAX_COOKIES), getConnection().getUndertowOptions().get(UndertowOptions.ALLOW_EQUALS_IN_COOKIE_VALUE, false), requestHeaders.get(Headers.COOKIE), requestCookiesParam); }