HttpConfiguration setResponseHeaderSize is ineffective in 12.1.0

[snicoll]

Jetty version(s)
Jetty 12.1.0

Jetty Environment
EE 11

Java version/vendor (use: java -version)
Any

OS type/version
Any

Description
When trying to upgrade Spring Boot to Jetty 12.1.0, we discovered that the fix for #12882 does not seem to apply. The original issue occurs again exactly as described in #12882.

[joakime]

Are you testing with HTTP/1.1, HTTP/2 or HTTP/3 ?

[snicoll]

Should it matter? HTTP/1.1, same as the original issue.

[joakime]

Should it matter? HTTP/1.1, same as the original issue.

It matters.

• HTTP/1.1 the setting is number of bytes for the entire buffer including the response line (status code, reason, and version).
• HTTP/2 the setting is the number of items in the header list for the HTTP/2 protocol for that specific stream before HPACK (has no relation to number of bytes) - the status code isn't part of this count.
• HTTP/3 the setting is the number of items in the header list for the HTTP/3 protocol not counting QPACK behaviors (has no relation to number of bytes) - the status code isn't part of this count.

[joakime]

Do you have a test that replicates your report?
Our test cases show it is working as designed on 12.1.0 release.

[snicoll]

It matters.

I know there must be some subtle difference between the protocols but our use case is very simple. Set a max, sent a response that goes beyond that max and validate it fails.

Do you have a test that replicates your report?

Certainly. First make sure you have JDK24 as our build requires it

git clone https://github.com/snicoll/spring-boot.git jetty-13483
cd jetty-13483
git checkout jetty-13483
./gradlew :smoke-test:spring-boot-smoke-test-jetty:test

Then smoketest.jetty.SampleJettyApplicationTests > testMaxHttpResponseHeaderSize() should fail.

[joakime]

In your example, I find nothing calling HttpConfiguration.setMaxResponseHeaderSize(int).

The testcase does the following ...

The following response headers are set by the ee11 endpoint ...

Date: Tue, 19 Aug 2025 20:07:35 GMT
Vary: Accept-Encoding
x-max-header: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Content-Type: text/plain;charset=utf-8
Content-Encoding: gzip
Content-Length: 31

The HttpConfiguration has the following settings at this point in time.

• responseHeaderSize = 4096 // the buffer size default
• maxResponseHeaderSize = 16384 // the maximum size of the response headers

The HTTP Response generation (HttpGenerator.generateResponse())

1. The response line is generated into headers - now java.nio.DirectByteBuffer[pos=17 lim=4096 cap=4096] // default buffer size
2. The Date header is generated into headers and checkMaxHeaderBytes(headers) allows it. - now java.nio.DirectByteBuffer[pos=54 lim=4096 cap=4096]
3. The Vary header is generated into headers and checkMaxHeaderBytes(headers) allows it. - now java.nio.DirectByteBuffer[pos=77 lim=4096 cap=4096]
4. The x-max-header was attempted to be generated, but results in a BufferOverflowException
5. The loop handling State.HEADER_OVERFLOW increases the headers buffer to be maxResponseHeaderSize and tries to generate the headers again.
6. The response line is generated into headers - now java.nio.DirectByteBuffer[pos=17 lim=16384 cap=16384] // max response size
7. The Date header is generated - now java.nio.DirectByteBuffer[pos=54 lim=16384 cap=16384]
8. The Vary header is generated - now java.nio.DirectByteBuffer[pos=77 lim=16384 cap=16384]
9. The x-max-header header is generated - now java.nio.DirectByteBuffer[pos=4190 lim=16384 cap=16384]
10. The Content-Type header is generated - now java.nio.DirectByteBuffer[pos=4230 lim=16384 cap=16384]
    etc ...

Each check against HttpGenerator.checkMaxHeaderBytes(headers) after the growth to maxResponseHeaderSize allows the generated headers, as the generated size is still below the stated HttpConfiguration.setMaxResponseHeaderSize(int).

[joakime]

Your not going to see a 500 status response without setting the HttpConfiguration.setMaxResponseHeaderSize(int) to something smaller than the generated size.

I see the code calling HttpConfiguration.setResponseHeaderSize(int), but that's just configuring a response buffer size, not a maximum size (like the spring property ${server.jetty.max-http-response-header-size} hints at)

[snicoll]

Your not going to see a 500 status response without setting the HttpConfiguration.setMaxResponseHeaderSize(int) to something smaller than the generated size.

I think we need to take a step back. The original report that I've linked to describes the behavior and that behavior got fixed. It is the exact same test, with the exact same setup, except that the Jetty version is different. So if the above is what should be happening, why was the original issue fixed, and why is that code working with Jetty 12.0.x?

[joakime]

I think we need to take a step back. The original report that I've linked to describes the behavior and that behavior got fixed. It is the exact same test, with the exact same setup, except that the Jetty version is different. So if the above is what should be happening, why was the original issue fixed, and why is that code working with Jetty 12.0.x?

The configuration HttpConfiguration.responseHeaderSize in 12.0.x is just a buffer size default.
The configuration HttpConfiguration.maxResponseHeaderSize in 12.0.x is the maximum header size check. (even in 12.0.x, this is the configuration you should be using)

In fact, in 12.0.x and 12.1.x your ${server.jetty.max-http-response-header-size} property is the HttpConfiguration.maxResponseHeaderSize setting. I would suggest you make that change in both 12.0.x and 12.1.x.

Since you have no releases using Jetty 12.1.0 or Jetty 12.1.0's ee11 mode, I would suggest you make this change now.

The size check is as follows.

maxResponseHeaderSize is the size limit. If you set it to -1, then the java.nio.BufferOverflowException of the ByteBuffer from the header created from responseHeaderSize is used as the trigger of the 500.

The change in 12.0.x was to set the maxResponseHeaderSize to -1 in the code.
This was a stop-gap for your project as you had existing releases with 12.0.x that didn't use the maxResponseHeaderSize yet.
12.1.0 release doesn't have that stopgap.

[snicoll]

This was a stop-gap for your project as you had existing releases with 12.0.x that didn't use the maxResponseHeaderSize yet.

We were not aware of that. I think this can be closed.