Deprecate server.max-http-header-size in favor of new server.max-http-request-header-size property

I am using the embedded Jetty Container and came across the problem that the server.max-http-header-size property is “only” used to set the size of the request header. Jetty differentiates between request and response header size. I know, that you can set the response header size by providing your own customizer. But the name of the property indicates that it affects all header sizes not only the request ones. So wouldn’t it make sense to use the property on both response and request header size?

As of now the JettyWebServerFactoryCustomizer only uses setRequestHeaderSize but in my opinion should also use setResponseHeaderSize

I am more than happy to provide the minimal change in a pull request if this change is seen as useful.

[markt-asf]

Yes, please raise an issue. I suspect we’ll separate them out into two new settings with the old setting being used as a default and removed for 10.1.x onwards.

[wilkinsona]

We’re going to introduce server.max-http-request-header-size. We’d like to keep server.max-http-header-size in a deprecated form but that will require us to keep its current behaviour. If both properties are set, we should throw an exception. If that proves to be too complicated, we may just remove server.max-http-header-size.

We are not going to introduce Jetty- and Tomcat-specific properties for the response header size at this time. We may do so in the future, however.