alibaba/Sentinel · error · IllegalStateException

Request body is too big, limit size is 4194304

Error message

Request body is too big, limit size is 4194304

What it means

SimpleHttpResponseParser enforces a hard cap on response body size, MAX_BODY_SIZE = 4 * 1024 * 1024 (4194304 bytes). After writing buffered body bytes (and while streaming the remainder) it checks out.size() > MAX_BODY_SIZE and throws IllegalStateException("Request body is too big, limit size is 4194304"). This protects the heartbeat client's memory from unbounded responses.

Source

Thrown at sentinel-transport/sentinel-transport-simple-http/src/main/java/com/alibaba/csp/sentinel/transport/heartbeat/client/SimpleHttpResponseParser.java:102

                            //When the `Content-Length` is absent, parse the rest of the bytes as body directly.
                            //if (contentLength == -1) {
                            //    contentLength = MAX_BODY_SIZE;
                            //}

                            // Parse HTTP body.
                            // When the `Content-Length` is absent, drop the body, return directly.
                            response = new SimpleHttpResponse(statusLine, headers);
                            if (contentLength <= 0) {
                                return response;
                            }
                            ByteArrayOutputStream out = new ByteArrayOutputStream(1024);
                            // `Content-Length` is not equal to exact length.
                            if (contentLength < len - parseBg) {
                                throw new IllegalStateException("Invalid content length: " + contentLength);
                            }
                            out.write(buf, parseBg, len - parseBg);
                            if (out.size() > MAX_BODY_SIZE) {
                                throw new IllegalStateException(
                                    "Request body is too big, limit size is " + MAX_BODY_SIZE);
                            }
                            int cap = Math.min(contentLength - out.size(), buf.length);
                            while (cap > 0 && (len = in.read(buf, 0, cap)) > 0) {
                                out.write(buf, 0, len);
                                cap = Math.min(contentLength - out.size(), buf.length);
                            }
                            response.setBody(out.toByteArray());
                            return response;
                        } else if (!line.trim().isEmpty()) {
                            // Parse HTTP header.
                            int idx2 = line.indexOf(":");
                            String key = line.substring(0, idx2).trim();
                            String value = line.substring(idx2 + 1).trim();
                            headers.put(key, value);
                            if ("Content-Length".equalsIgnoreCase(key)) {
                                contentLength = Integer.parseInt(value);
                            }

View on GitHub (pinned to a3f40ba8e9)

Solutions

1. Verify the heartbeat/dashboard URL configuration points at the real Sentinel dashboard receiver that returns a short ack
2. Check what the configured URL actually returns (curl -s <url> | wc -c); large output means wrong endpoint or proxy interception
3. Fix the server to keep heartbeat/command responses small; 4 MB is generous for the intended ack payloads

Example fix

# before: heartbeat URL points at a data endpoint returning >4MB
curl -s http://ops.example.com/api/metrics/all | wc -c   # 30000000

# after: point at the dashboard heartbeat receiver
curl -s http://dashboard:8080/api/registry/machine | wc -c   # small ack

// verify the target endpoint returns a small ack before wiring heartbeat
URLConnection c = new URL(heartbeatUrl).openConnection();
long len = c.getContentLengthLong();
if (len > 4 * 1024 * 1024) {
    throw new IllegalStateException("endpoint body exceeds 4MB parser limit: " + heartbeatUrl);
}

try {
    response = parser.parse(in);
} catch (IllegalStateException e) { // 'Request body is too big'
    // wrong endpoint or proxy interference; fail loudly with the URL for diagnosis
    throw new IllegalStateException("Oversized response from " + url + "; check dashboard config", e);
}

When it happens

Trigger: The HTTP endpoint the simple-http transport calls (normally the dashboard heartbeat receiver) returning a body larger than 4 MB — e.g. a misrouted URL that now returns a big page/JSON, or a dashboard endpoint whose response grew past the cap.

Common situations: Wrong dashboard URL configured (csp.sentinel.dashboard.acapi / heartbeat URL pointing at an endpoint that returns large content); a reverse proxy serving an error page or full report instead of the small heartbeat ack; environment promotion where the URL now resolves to a different service.

Related errors

• Only form-encoded post request is supported
• No legal Content-Length
• buf index out of range: {bg}, buf.length={len}
• Parameter key cannot be empty
• Metadata key cannot be empty

AI-assisted analysis of alibaba/Sentinel@a3f40ba8e9 (2026-08-14). Data as JSON: /api/errors/664f74310596697b. Report an issue: GitHub.