Request header field exceeding server limit

Question

My web application is giving an error for one of my users:

Bad Request Your browser sent a request that this server could not understand. Size of a request header field exceeds server limit

It seems the cookies I am using have made the request header too long to handle. The old trouble is that I don't get the same error and nor do any other users. Which leads me to believe it is specific to this particular user's setup.

Their IT guys says that they do not use a proxy server, but they do use WCCP (whatever that is!) Can anyone suggest why this might be happening?

Answer 1

A browser can send cookies that are generic for your domain (e.g. for example.com as well as those for webapp.example.com) - it may be that these cookies were actually set by an unrelated site whose domain name ends with the same TLD.

HTTP Proxies can add their own HTTP headers to responses and requests. They can also change existing HTTP headers.

Either of these could push up the size of the HTTP header.

The best way to find out what is happening is to record the HTTP request. This could be done by using a packet sniffer such as Wireshark or tcpdump at either the user's PC or at the server - I'd filter by the other end's IP-address.

Obviously, if you can minimise the number and size of your cookies, this will help. Ideally cookies would just contain a reference-ID for state information stored at the server.