{"record":{"id":"18cf759cb59d7f8e","repo":"apple/pkl","slug":"invalidhttpheadervaluetoolong","errorCode":"invalidHttpHeaderValueTooLong","errorMessage":"HTTP Header value is invalid because it is longer than 4096 characters. Value: `{0}`","messagePattern":"HTTP Header value is invalid because it is longer than 4096 characters\\. Value: `(.+?)`","errorType":"error_code","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/util/IoUtils.java","lineNumber":953,"sourceCode":"    }\n\n    if (hasReservedHeaderPrefix(headerName)) {\n      throw new IllegalArgumentException(\n          ErrorMessages.create(\"invalidHttpHeaderReservedPrefix\", headerName));\n    }\n\n    if (!headerNameLike.matcher(headerName).matches()) {\n      throw new IllegalArgumentException(ErrorMessages.create(\"invalidHttpHeaderName\", headerName));\n    }\n  }\n\n  public static void validateHeaderValue(String headerValue) {\n    if (!headerValueLike.matcher(headerValue).matches()) {\n      throw new IllegalArgumentException(\n          ErrorMessages.create(\"invalidHttpHeaderValue\", headerValue));\n    }\n    if (headerValue.length() > 4096) {\n      throw new IllegalArgumentException(\n          ErrorMessages.create(\"invalidHttpHeaderValueTooLong\", headerValue));\n    }\n  }\n\n  private static @Nullable String getFilenameExtension(String fileName) {\n    var dotIndex = fileName.lastIndexOf('.');\n    // 0 if hidden file (e.g. `.gitignore`); not an extension\n    if (dotIndex == -1 || dotIndex == 0) {\n      return null;\n    }\n    return fileName.substring(dotIndex + 1);\n  }\n\n  public static @Nullable Path findExecutableOnPath(String executable) {\n    var pathEnvVar = System.getenv(\"PATH\");\n    if (pathEnvVar == null) {\n      return null;\n    }","sourceCodeStart":935,"sourceCodeEnd":971,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/util/IoUtils.java#L935-L971","documentation":"Validation in IoUtils (validateHeaderValue region): an HTTP header value exceeding 4096 characters is rejected with IllegalArgumentException before it can reach the HTTP client. The input at fault is an oversized header value, typically supplied via evaluator HTTP headers or resource reader options.","triggerScenarios":"Configuring an external HTTP header whose value length exceeds 4096, e.g. embedding a huge JWT, certificate, or blob in a header via EvaluatorSettings externalHttpHeaders.","commonSituations":"Very long JWT/OAuth tokens, inline-encoded certificates, or accidentally concatenating multiple values into one header.","solutions":["Shorten the header value below 4096 characters.","Move bulk data out of headers into the request body or a different transport."],"exampleFix":"// before\n[\"X-Data\"] = veryLargeBlob // 5000+ chars\n// after\n[\"X-Data-Ref\"] = \"s3://bucket/data.json\"","handlingStrategy":"validation","validationCode":"if (value != null && value.length() > 4096) throw new IllegalArgumentException(\"header value too long: \" + value.length());","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep large payloads in bodies or files, not headers.","Deduplicate/normalize long tokens (JWTs, certs) before use.","Check length limits of intermediaries (proxies often cap at 4-8KB per header block)."],"tags":["http","validation","limits"],"backgroundTag":"value-out-of-range","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}