Discourse session cookies (400 Request Header Or Cookie Too Large)

[maltfield (Michael Altfield)]

@maltfield

Tuning down the following nginx directives is commonly done as part of hardening nginx (to address availability, rate limiting, DOS, etc):

limit_conn_zone limit_conn limit_req_zone client_body_timeout client-header_timeout ssl_* add_header # SAMEORIGIN/XSS-Protection/CORS/CSP client_body_buffer_size client_header_buffer_size large_client_header_buffers client_max_body_size

Note: I’ve also had to override my hardened nginx config’s large_client_header_buffers directive to get Discourse working.

Specifically, I use large_client_header_buffers 2 1k for all my other sites’ nginx configs. But this causes a 414 Request-URI Too Large error from /admin/reports/bulk?XYZ – where XYZ is actually 1,019 characters long!

This was fixed by setting large_client_header_buffers 4 8k; in my Discourse nginx config’s server{} block, which overrides the global directive and restores the directive to its default value for Discourse

• Module ngx_http_core_module

For better interoperability of Discourse installs through popular hardened web servers, network firewalls, and web application firewalls, I urge the Discourse developers to consider using POST for such long query strings.