Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-39402

Jenkins creates massive HTTP headers that blows up proxies

    XMLWordPrintable

Details

    Description

      When Jenkins serves an access denied for a page it includes in the HTTP headers ever group that the current user is a member of.

      In a large corporate environment this can be hundreds of groups which causes many KBs of headers.
      nginx, HAProxy, Apache HTTPd and other proxies limit the maximum size and number of HTTP headers - so in this case instead of the access denied the user would see a 502 error from the proxy which hides the underlying issue. (FWIW HAProxy limits the number of headers to 101 - and classes an application that uses more than this amount of headers as buggy)

      There is no reason to send all the list of groups by default - it perhaps could be enabled by a property but default to disabled, but in reality exposing what permission you need to the end user and what permissions they have is rarely (if ever) used.

      This is the code in question that needs fixing.

      Attachments

        Issue Links

          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. JENKINS-35418 Unauthorized user gets HTTP 500 when member of many groups

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. JENKINS-36805 Response buffer overflow when logging in as user w/o Jenkins permissions set

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. JENKINS-38720 500 Server Error when notifying master of new mercurial commit: "Response header too large"

          • Major - Major loss of function.
          • In Review

          Bug - A problem which impairs or prevents the functions of the product. JENKINS-46929 "Response header too large" when notifying master of new git commit

          • Major - Major loss of function.
          • Closed
          links to

          Web Link CloudBees Internal OSS-1611

          Web Link PR 2727

          Activity

            People

              jglick Jesse Glick
              teilo James Nord
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: