ERR_EMPTY_RESPONSE when GET URL is too long

[industral]

When you make GET with very long URL, you will get ERR_EMPTY_RESPONSE, and no logs can show it... When server is down - ERR_CONNECTION_REFUSED - so browser can't connect to server.

So it looks like express accept connection but can't response for some reason.

I know that very long URL is bad practice, but it's legacy project, and I would like to know what is workaround for that issue.

Thanks.

[dougwilson]

This issue in in Node.js core itself; the http server is closing the connection on this condition before Express is able to see anything. Unfortunately you'd need to file an issue with Node.js core to see if there is a work-around or if something can be implemented.

You can validate this by removing Express and trying a very long URL:

var http = require('http')
http.createServer(function (req, res) { res.end('hello!') }).listen(3000)

Then make a request:

$ curl http://localhost:3000/$(head -c 100000 < /dev/zero | tr '\0' '\141')
curl: (52) Empty reply from server

[industral]

@dougwilson Thanks!

[hingermayank]

@dougwilson @industral Were you able to find any solution to this? Which node version were you using?

I was earlier using node 8.x and recently I had switched to node 10.x. After the upgrade, I am seeing this issue in development mode. However this is fine on production builds.

[jonchurch]

@hingermayank I don't think this has been fixed in Node Core yet, but I believe this PR was an attempt to introduce a flag that lets you increase the max size of a URL nodejs/node#26553

As for why that issue is cropping up for you in Dev when moving from 8 to 10, I honestly can't say why that would happen

[hingermayank]

@jonchurch It is happening on prod as well. Sorry for the confusion. I had gone through the PR but I am not sure what changed in Node 10 that broke this. I came across this change from Node: nodejs/node#24731

But not sure how this would affect request with long urls or too many query strings.

[jonchurch]

Ahh thanks for linking that issue. There was a change in v10.14.1 that changed the max HTTP header size from 80kb to 8kb (to prevent some security vulns, and 8kb was picked because that's what NGINX uses as the max by default to protect from a similar vulnerability).

That was a breaking change for some folks, and is likely why you're experiencing the issue.

There is a Node Option you can set to increase the max HTTP Header size, which may solve your issue. The option is --max-http-header-size which can be set as a CLI flag at runtime, or as an ENV variable through the NODE_OPTIONS env var.

I believe that the resource URL is counted as part of the HTTP Header, triggering this behavior.

However, the existence of the PR I linked before suggests that there may still be an issue with long URL strings.

P.S. I don't like recommending this, but using a version below 10.14.1 should avoid this issue. Rolling back security releases is not a good idea, but it should get you back to a state without the issue.