From efe145a99433f071f6938a33bddca10dd50788a5 Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Fri, 6 Nov 2026 15:59:51 -0700 Subject: [PATCH 1/2] docs: administration: configuring-fluent-bit: document http_server.http1_max_header_size - add http_server.http1_max_header_size to the shared HTTP listener settings table (default 32KiB, binary units, 0 selects default) - add HTTP/1 request header limits subsection: what the limit counts, early rejection conditions, 413 when buffer_max_size is reached first, HTTP/2 scope, invalid values and fractional truncation - documents fluent/fluent-bit#12718 Signed-off-by: Eric D. Schabell --- .../yaml/pipeline-section.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/administration/configuring-fluent-bit/yaml/pipeline-section.md b/administration/configuring-fluent-bit/yaml/pipeline-section.md index f0712db73..86aee9444 100644 --- a/administration/configuring-fluent-bit/yaml/pipeline-section.md +++ b/administration/configuring-fluent-bit/yaml/pipeline-section.md @@ -169,6 +169,7 @@ plugin-specific behavior. | `http_server.http2` | Enable HTTP/2 support for the input listener. | `true` | | `http_server.buffer_max_size` | Set the maximum size of the HTTP request buffer. | `4M` | | `http_server.buffer_chunk_size` | Set the allocation chunk size used for the HTTP request buffer. | `512K` | +| `http_server.http1_max_header_size` | Set the maximum size of an HTTP/1 request line and headers, including the line-ending characters. Uses binary units: `K`, `KB`, and `KiB` all mean 1,024 bytes, and `M`/`G` scale the same way. `0` selects the default. The `http_server.buffer_max_size` limit still applies. See the HTTP/1 request header limits section after this table. | `32KiB` | | `http_server.max_connections` | Set the maximum number of concurrent active HTTP connections. `0` means unlimited. | `0` | | `http_server.workers` | Set the number of HTTP listener worker threads. | `1` | | `http_server.ingress_queue_event_limit` | Set the maximum number of deferred ingress queue entries. This setting applies only when `http_server.workers` is greater than `1`. | `8192` | @@ -179,6 +180,21 @@ When `http_server.workers` is `1`, Fluent Bit does not use the deferred ingress queue, so the two `http_server.ingress_queue_*` settings have no effect. +#### HTTP/1 request header limits + +Fluent Bit reads the request line and headers of each HTTP/1 request before it processes the request. The `http_server.http1_max_header_size` limit counts the request line, the headers, and the blank line that ends them. Fluent Bit closes the connection without a response when: + +- The request line and headers reach `http_server.http1_max_header_size` without the blank line that ends them. +- The request method is longer than 11 bytes. +- The request target contains a carriage return or line feed. +- The protocol version doesn't start with `HTTP/1.`. + +If the request reaches `http_server.buffer_max_size` first, Fluent Bit responds with `413 Request Entity Too Large` and closes the connection. Setting `http_server.http1_max_header_size` higher than `http_server.buffer_max_size` has no effect beyond the buffer limit. + +These checks apply to HTTP/1 requests, including HTTP/1.1 requests that ask to upgrade to HTTP/2. Connections that start directly with the HTTP/2 connection preface aren't affected. + +Fluent Bit fails to start if `http_server.http1_max_header_size` isn't a number, is negative, or has a suffix other than `K`, `KB`, `KiB`, `M`, `MB`, `MiB`, `G`, `GB`, or `GiB`, and logs `[http_server] invalid http_server.http1_max_header_size`. The suffixes aren't case-sensitive and must follow the number without a space. Fractional values are truncated to whole bytes, and values that truncate to `0` select the default. + For backward compatibility, some plugins also accept the legacy aliases `http2`, `buffer_max_size`, `buffer_chunk_size`, `max_connections`, and `workers`. These plugins also pause and resume the shared listener in response to [backpressure](../../backpressure.md#pause-behavior-for-http-based-inputs). While an input is paused, Fluent Bit accepts and immediately closes incoming connections instead of buffering the requests, so clients must retry. From bc557f336607227057201a4335a3cb5792614d62 Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Sat, 7 Nov 2026 09:23:30 -0700 Subject: [PATCH 2/2] docs: administration: configuring-fluent-bit: address review feedback on http1_max_header_size - note http_server.http1_max_header_size is supported in v5.2 or later; only the size limit is new, request-line rejections predate it - add upgrade impact: earlier versions bounded headers only by buffer_max_size; from v5.2, headers at the 32KiB default are dropped without a response or log, so raise the limit for large headers - move the legacy alias and backpressure paragraphs before the HTTP/1 subsection; they apply to the whole shared listener - note newer http_server.* keys have no legacy alias; link the HTTP/1 section by anchor Signed-off-by: Eric D. Schabell --- .../yaml/pipeline-section.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/administration/configuring-fluent-bit/yaml/pipeline-section.md b/administration/configuring-fluent-bit/yaml/pipeline-section.md index 86aee9444..2ff0c9e5a 100644 --- a/administration/configuring-fluent-bit/yaml/pipeline-section.md +++ b/administration/configuring-fluent-bit/yaml/pipeline-section.md @@ -169,7 +169,7 @@ plugin-specific behavior. | `http_server.http2` | Enable HTTP/2 support for the input listener. | `true` | | `http_server.buffer_max_size` | Set the maximum size of the HTTP request buffer. | `4M` | | `http_server.buffer_chunk_size` | Set the allocation chunk size used for the HTTP request buffer. | `512K` | -| `http_server.http1_max_header_size` | Set the maximum size of an HTTP/1 request line and headers, including the line-ending characters. Uses binary units: `K`, `KB`, and `KiB` all mean 1,024 bytes, and `M`/`G` scale the same way. `0` selects the default. The `http_server.buffer_max_size` limit still applies. See the HTTP/1 request header limits section after this table. | `32KiB` | +| `http_server.http1_max_header_size` | Set the maximum size of an HTTP/1 request line and headers, including the line-ending characters. Uses binary units: `K`, `KB`, and `KiB` all mean 1,024 bytes, and `M`/`G` scale the same way. `0` selects the default. The `http_server.buffer_max_size` limit still applies. Supported in v5.2 or later. See [HTTP/1 request header limits](#http1-request-header-limits). | `32KiB` | | `http_server.max_connections` | Set the maximum number of concurrent active HTTP connections. `0` means unlimited. | `0` | | `http_server.workers` | Set the number of HTTP listener worker threads. | `1` | | `http_server.ingress_queue_event_limit` | Set the maximum number of deferred ingress queue entries. This setting applies only when `http_server.workers` is greater than `1`. | `8192` | @@ -180,25 +180,27 @@ When `http_server.workers` is `1`, Fluent Bit does not use the deferred ingress queue, so the two `http_server.ingress_queue_*` settings have no effect. +For backward compatibility, some plugins also accept the legacy aliases `http2`, `buffer_max_size`, `buffer_chunk_size`, `max_connections`, and `workers`. The other `http_server.*` keys, such as `http_server.http1_max_header_size`, have no alias and must use the full name. + +All inputs that use the shared listener also pause and resume it in response to [backpressure](../../backpressure.md#pause-behavior-for-http-based-inputs). While an input is paused, Fluent Bit accepts and immediately closes incoming connections instead of buffering the requests, so clients must retry. + #### HTTP/1 request header limits Fluent Bit reads the request line and headers of each HTTP/1 request before it processes the request. The `http_server.http1_max_header_size` limit counts the request line, the headers, and the blank line that ends them. Fluent Bit closes the connection without a response when: -- The request line and headers reach `http_server.http1_max_header_size` without the blank line that ends them. +- The request line and headers reach `http_server.http1_max_header_size` without the blank line that ends them. This limit is new in v5.2. - The request method is longer than 11 bytes. - The request target contains a carriage return or line feed. - The protocol version doesn't start with `HTTP/1.`. If the request reaches `http_server.buffer_max_size` first, Fluent Bit responds with `413 Request Entity Too Large` and closes the connection. Setting `http_server.http1_max_header_size` higher than `http_server.buffer_max_size` has no effect beyond the buffer limit. +Earlier versions don't enforce a separate header size limit; only `http_server.buffer_max_size`, `4M` by default, bounds the request line and headers. In v5.2 or later, requests whose headers reach the `32KiB` default, for example because of large cookies or tokens, are dropped without a response or a log message. If your clients send large headers, raise `http_server.http1_max_header_size` before you upgrade. + These checks apply to HTTP/1 requests, including HTTP/1.1 requests that ask to upgrade to HTTP/2. Connections that start directly with the HTTP/2 connection preface aren't affected. Fluent Bit fails to start if `http_server.http1_max_header_size` isn't a number, is negative, or has a suffix other than `K`, `KB`, `KiB`, `M`, `MB`, `MiB`, `G`, `GB`, or `GiB`, and logs `[http_server] invalid http_server.http1_max_header_size`. The suffixes aren't case-sensitive and must follow the number without a space. Fractional values are truncated to whole bytes, and values that truncate to `0` select the default. -For backward compatibility, some plugins also accept the legacy aliases `http2`, `buffer_max_size`, `buffer_chunk_size`, `max_connections`, and `workers`. - -These plugins also pause and resume the shared listener in response to [backpressure](../../backpressure.md#pause-behavior-for-http-based-inputs). While an input is paused, Fluent Bit accepts and immediately closes incoming connections instead of buffering the requests, so clients must retry. - ### Incoming `OAuth 2.0` `JWT` validation settings The HTTP-based input plugins that support bearer token validation share the following `oauth2.*` settings: