FlowiseAI/Flowise · error · Error

Invalid header "${key}": key exceeds ${MAX_KEY_LENGTH} chars

Error message

Invalid header "${key}": key exceeds ${MAX_KEY_LENGTH} chars

What it means

Per-entry guard: each key must be at most MAX_KEY_LENGTH (128) characters. Header names longer than 128 chars are rejected.

Source

Thrown at packages/components/src/headerValidation.ts:54

 * sensitive header names, and oversized payloads. Throws a plain Error; callers
 * are responsible for mapping to their own error types.
 */
export function validateCustomHeaders(headers: Record<string, string>): void {
    if (!headers || typeof headers !== 'object') {
        throw new Error('Invalid headers: expected an object')
    }

    const entries = Object.entries(headers)
    if (entries.length > MAX_HEADERS) {
        throw new Error(`Invalid headers: too many entries (max ${MAX_HEADERS})`)
    }

    for (const [key, value] of entries) {
        if (typeof key !== 'string' || key.length === 0) {
            throw new Error('Invalid header: key must be a non-empty string')
        }
        if (key.length > MAX_KEY_LENGTH) {
            throw new Error(`Invalid header "${key}": key exceeds ${MAX_KEY_LENGTH} chars`)
        }
        if (!RFC7230_TOKEN.test(key)) {
            throw new Error(`Invalid header "${key}": key contains illegal characters`)
        }

        const lower = key.toLowerCase()
        if (DENIED_HEADER_NAMES.has(lower) || DENIED_HEADER_PREFIXES.some((p) => lower.startsWith(p))) {
            throw new Error(`Invalid header "${key}": this header name is not allowed`)
        }

        if (typeof value !== 'string') {
            throw new Error(`Invalid header "${key}": value must be a string`)
        }
        if (value.length > MAX_VALUE_LENGTH) {
            throw new Error(`Invalid header "${key}": value exceeds ${MAX_VALUE_LENGTH} chars`)
        }
        for (let i = 0; i < value.length; i++) {
            const code = value.charCodeAt(i)

View on GitHub (pinned to abe4a8601a)

Solutions

  1. Shorten the header name to <=128 chars.
  2. If you have a long token/URL, it belongs in the VALUE, not the key.
  3. Check for accidental key/value inversion at the caller.

Example fix

// before
validateCustomHeaders({ 'Bearer eyJhbGc...very-long-jwt...': '' }) // key/value swapped -> throws

// after
validateCustomHeaders({ 'Authorization': 'Bearer eyJhbGc...very-long-jwt...' })
Defensive patterns

Strategy: validation

Validate before calling

// Reject over-long keys before validation
const MAX_KEY_LENGTH = 128
function dropOversizedKeys(headers) {
    return Object.fromEntries(Object.entries(headers).filter(([k]) => typeof k === 'string' && k.length <= MAX_KEY_LENGTH))
}

Type guard

function keysWithinLength(headers, max = 128) {
    return Object.keys(headers).every((k) => typeof k === 'string' && k.length <= max)
}

Try / catch

try {
    validateCustomHeaders(headers)
} catch (e) {
    if (/key exceeds.*chars/i.test(e.message)) {
        // flag the offending key to the user (its name is in the message)
    }
    throw e
}

Prevention

When it happens

Trigger: Header bag contains a name longer than 128 characters.

Common situations: Key/value swap — a long value (token, URL) accidentally placed as the key; a generated/internal pseudo-header name that grew pathologically long; a pasted blob used as the name.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/ed840eccae329449. Report an issue: GitHub.