Add capability to increase the maximum HTTP header size more than 8 Kb

Unfortunately I cannot provide steps to reproduce but I’ll try to describe what I’m experiencing and my findings.

So, I run testcafe from command line with 3 concurrent Chrome instances. Test execute correctly for approx 20 minutes and then all die. I’ve tried splitting them with simple bash script that iterates over *-test.js files and effectively launches each fixture separately. Funny thing is that it still behaved the same if I launched them under same shell like this

find ./test/functional -name '*-test.js' -type f|while read fname; do
  UV_THREADPOOL_SIZE=64 NODE_OPTIONS=--max-old-space-size=3072 node node_modules/.bin/testcafe chrome:headless:emulation ${fname} --skip-uncaught-errors -s test/functional/logs/screenshots -S --skip-uncaught-errors -c 3
done

but launching another shell seems to be kind of a workaround (not very convenient one and doesn’t solve the underlying issue

find ./test/functional -name '*-test.js' -type f|while read fname; do
  bash -c "UV_THREADPOOL_SIZE=64 NODE_OPTIONS=--max-old-space-size=3072 node node_modules/.bin/testcafe chrome:headless:emulation ${fname} --skip-uncaught-errors -s test/functional/logs/screenshots -S --skip-uncaught-errors -c 3"
done

So, I’ve started digging, hooked into Chrome log and saw this happening when I start to experience issues

{
	"source": "network",
	"text": "Failed to load resource: the server responded with a status of 400 (Bad Request)",
	"timestamp": 1570746708551.19,
	"url": "http://192.168.1.10:54924/messaging",
	"networkRequestId": "1000070769.29649",
}

At this point testcafe tries to restart browser 3 times and constantly bumps into same issue which results in

ERROR The HeadlessChrome 77.0.3865 / Mac OS X 10.14.5 browser disconnected. This problem may appear when a browser hangs or is closed, or due to network issues.

I’ve traced that in my case it always happens on test with a page that contains a lot of high res images. Note that this test passes if run separately, also entire fixture containing that test (and ~20 others) passes. The problem occurs only on long execution with much more tests.

So, I’ve went to your code at node_modules/testcafe-hammerhead/lib/proxy/index.js and done the following change

    const errorHandler = (err, socket) => {
      console.log('CLIENT ERROR');
      console.error(err);
    };
    this.server1.on('connection', handler);
    this.server2.on('connection', handler);
    this.server1.on('clientError', errorHandler);
    this.server2.on('clientError', errorHandler);

which revealed

CLIENT ERROR
{ [Error: Parse Error]
  bytesParsed: 14500,
  code: 'HPE_HEADER_OVERFLOW',
  rawPacket:
   <Buffer 4b 6f 63 68 61 6d 20 43 69 65 20 73 7a 61 6c 6f 6e 79 20 4b 75 73 69 63 7a 6b 75 20 3c 33 ... > }

I’ve forced setting --max-http-header-size=80000 and it seems to address that particular issue. Maybe you could set this one by default for proxy? Otherwise as far as I can tell due to CVE-2018-12121 it was limited by default to 8kB on 27th of November 2018. Since hammerhead proxy is not a production server I don’t think it needs to be protected from that kind of attack.

Some background https://www.nearform.com/blog/protecting-node-js-from-uncontrolled-resource-consumption-headers-attacks/

Another question would be why header size grows over time so much

[miherlosev]

Hi @andrzej-kodify,

We will think about adding logging of client errors in development mode. Also, we are going to add an option to increase the maximum header size because other web servers can limit the maximum size of an HTTP header with the size of more than 8 kb.

[AndreyBelym]

#2398 implemented lifted the max header size limit to the old default (80kB) and added a descriptive error message for the header overflow error. The error message suggests adding the --max-http-header-size=XXXX' to the NODE_OPTIONS` environment variable. When a header overflow error is thrown, we detect the problematic header, measure its size and calculate the recommended limit to be as twice as the problematic header size. The recommended limit is included in the error message, so you can just copy suggested instructions to your terminal or build scripts to avoid the error.