FlowiseAI/Flowise · warning · Error

Invalid header "${key}": value exceeds ${MAX_VALUE_LENGTH} c

Error message

Invalid header "${key}": value exceeds ${MAX_VALUE_LENGTH} chars

What it means

Thrown by validateCustomHeaders() when a header value exceeds MAX_VALUE_LENGTH (2048 characters). This guard prevents oversized headers that could destabilize downstream proxies, CDNs, or target servers which impose their own limits. It is a defense against accidental large-payload injection (e.g. embedding entire documents or base64 blobs into a single header).

Source

Thrown at packages/components/src/headerValidation.ts:69

            throw new Error('Invalid header: key must be a non-empty string')
        }
        if (key.length > MAX_KEY_LENGTH) {
            throw new Error(`Invalid header "${key}": key exceeds ${MAX_KEY_LENGTH} chars`)
        }
        if (!RFC7230_TOKEN.test(key)) {
            throw new Error(`Invalid header "${key}": key contains illegal characters`)
        }

        const lower = key.toLowerCase()
        if (DENIED_HEADER_NAMES.has(lower) || DENIED_HEADER_PREFIXES.some((p) => lower.startsWith(p))) {
            throw new Error(`Invalid header "${key}": this header name is not allowed`)
        }

        if (typeof value !== 'string') {
            throw new Error(`Invalid header "${key}": value must be a string`)
        }
        if (value.length > MAX_VALUE_LENGTH) {
            throw new Error(`Invalid header "${key}": value exceeds ${MAX_VALUE_LENGTH} chars`)
        }
        for (let i = 0; i < value.length; i++) {
            const code = value.charCodeAt(i)
            if (code === 0x0d || code === 0x0a || (code < 0x20 && code !== 0x09)) {
                throw new Error(`Invalid header "${key}": value contains illegal control characters`)
            }
        }
    }
}

/**
 * Returns a copy of `headers` with credential-bearing entries (Authorization, Cookie, X-Api-Key, …)
 * replaced by a placeholder string. Used at trust boundaries before a header bag is exposed to flow
 * templates, observers, or logs. Comparison is case-insensitive; non-sensitive headers pass through.
 */
export function redactSensitiveHeaders(headers: Record<string, any> | undefined | null): Record<string, any> {
    if (!headers) return {}
    const out: Record<string, any> = {}

View on GitHub (pinned to abe4a8601a)

Solutions

Move large data out of headers into the request body or a side-channel store.
Truncate or hash the value if only a fingerprint is needed downstream.
Split the value across multiple custom headers if the downstream consumer supports reassembly.
If a legitimate value must exceed 2048 chars, raise MAX_VALUE_LENGTH in a fork only after confirming all downstream proxies/servers accept the larger size.

Example fix

// before
validateCustomHeaders({ Authorization: 'Bearer ' + hugeJwt })

// after
// move the token to the body or use a shorter reference token
validateCustomHeaders({ 'X-Auth-Ref': shortReferenceId })

Defensive patterns

Strategy: validation

Validate before calling

const MAX_VALUE_LENGTH = 2048
function truncateHeaders(headers: Record<string, string>): Record<string, string> {
  const out: Record<string, string> = {}
  for (const [k, v] of Object.entries(headers)) {
    out[k] = v.length > MAX_VALUE_LENGTH ? v.slice(0, MAX_VALUE_LENGTH) : v
  }
  return out
}
validateCustomHeaders(truncateHeaders(headers))

Try / catch

try {
  validateCustomHeaders(headers)
} catch (e) {
  if (String(e).includes('value exceeds')) {
    // log and drop or truncate the offending header
  }
  throw e
}

Prevention

Keep auth tokens short; use reference tokens instead of raw JWTs in headers.
Move large payloads to the request body.
Set up a lint rule or pre-commit check on config files that define static headers.

When it happens

Trigger: Passing a header whose value is longer than 2048 chars: a long Bearer/JWT token, a base64-encoded payload, a comma-separated allowlist of IDs, or a copied JSON blob. The check at line 68 (value.length > MAX_VALUE_LENGTH) fires after the type check passes.

Common situations: Embedding large auth tokens, passing serialized state objects, or forwarding trace/span context that accumulates. Some OAuth providers issue tokens over 2048 chars. Misconfiguring a metadata header to carry the full request body.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/6fa26d22bd95c771. Report an issue: GitHub.