Is there a size limit for HTTP response headers on Google App Engine?

Question

I was trying to run a profiler on some handler code up on appspot and was looking for a way to show the pstats output without writing directly to the response body (which is problematic for handlers responding with structured data such as JSON).

I decided to try writing the output to the response header, and added some js to my html-rendering handlers that could parse the header and console.log() it (turned out to be pretty simple and convenient to work with). For the non-html rendering handlers, I was thinking I might try and build a chrome extension to do something similar, but of course, whenever I'm making an ajax call to such a handler, the calling page (with the js to parse the header) can step in and handle the display.

All this looked good as I was testing on dev_appserver, but then I deployed to appspot and found that my custom header never showed up. I have similar pieces of code in this project that track the elapsed execution time of certain operations, and the custom headers I write that stuff to shows up fine.

I'm assuming there's a limit in place on appspot python runtime process that omits the header if it's greater than a certain length, but I don't see the size published anywhere on the developer site.

If there is in fact a limit, does anyone know what it is?

Answer 1

I cannot find any documentation about this, but the limit seems to be 497 bytes for the entire header line (including the key, the colon, the whitespace after the colon, but excluding the '\r\n' at the end of the line).

Here's a Go test handler:

func Test(c appengine.Context, w http.ResponseWriter, r *http.Request) {
    l, err := strconv.ParseInt(r.URL.Query().Get("len"), 10, 64)
    if err != nil {
        http.Error(w, "", http.StatusBadRequest)
        return
    }
    value := ""
    for l != 0 {
        value += "X"
        l--
    }
    w.Header().Set("Set-Cookie", value)
    w.Header().Set("Test-Header", value)
    w.Header().Set("Very-Very-Long-Test-Header", value)
    w.Header().Set(value, "Test-Value")
    w.WriteHeader(http.StatusNoContent)
}

Setting the len query parameter to 469 is the largest value that does not remove the Very-Very-Long-Test-Header header. 484 is the largest that will keep the Test-Header header, and 485 is the largest that will keep the Xxxxx… header.

They all add up to 497 per line, or if you will, 495 excluding the ": ".

NOTE that this limit does not apply to incoming (request) headers.

UPDATE: The Set-Cookie header has a different limit: 4108 bytes instead of 497.