{"record":{"id":"28169aac7b6ddde5","repo":"ratchetphp/Ratchet","slug":"maximum-buffer-size-of-this-maxsize-exceeded-parsing-http","errorCode":null,"errorMessage":"Maximum buffer size of {$this->maxSize} exceeded parsing HTTP header","messagePattern":"Maximum buffer size of (.+?) exceeded parsing HTTP header","errorType":"exception","errorClass":"OverflowException","httpStatus":null,"severity":"error","filePath":"src/Ratchet/Http/HttpRequestParser.php","lineNumber":36,"sourceCode":"     * @var int\n     */\n    public $maxSize = 4096;\n\n    /**\n     * @param \\Ratchet\\ConnectionInterface $context\n     * @param string                       $data Data stream to buffer\n     * @return \\Psr\\Http\\Message\\RequestInterface\n     * @throws \\OverflowException If the message buffer has become too large\n     */\n    public function onMessage(ConnectionInterface $context, $data) {\n        if (!isset($context->httpBuffer)) {\n            $context->httpBuffer = '';\n        }\n\n        $context->httpBuffer .= $data;\n\n        if (strlen($context->httpBuffer) > (int)$this->maxSize) {\n            throw new \\OverflowException(\"Maximum buffer size of {$this->maxSize} exceeded parsing HTTP header\");\n        }\n\n        if ($this->isEom($context->httpBuffer)) {\n            $request = $this->parse($context->httpBuffer);\n\n            unset($context->httpBuffer);\n\n            return $request;\n        }\n    }\n\n    /**\n     * Determine if the message has been buffered as per the HTTP specification\n     * @param  string  $message\n     * @return boolean\n     */\n    public function isEom($message) {\n        return strpos($message, static::EOM) !== false;","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/ratchetphp/Ratchet/blob/e621c6c40bf684bbbb877102416ad5303d05a9cc/src/Ratchet/Http/HttpRequestParser.php#L18-L54","documentation":"HttpRequestParser::onMessage accumulates incoming bytes in $context->httpBuffer until a complete HTTP header (terminated by \\r\\n\\r\\n) arrives. If the accumulated buffer exceeds $this->maxSize (default 4096 bytes) before the header terminates, it throws OverflowException — defending against clients that never finish the handshake or deliberately flood the server with header data.","triggerScenarios":"A client opens a TCP connection to the WebSocket port and streams more than maxSize bytes without sending the \\r\\n\\r\\n header terminator; sending one gigantic Cookie or header block larger than the limit; a raw TCP client or port scanner writing arbitrary bytes.","commonSituations":"Sending very large authentication cookies or JWTs in headers during the handshake on servers behind proxies that append extra headers; a misconfigured client that omits the blank line terminating the HTTP header; attackers flooding sockets (this guard is the mitigation — tighten or widen deliberately); proxying non-HTTP protocols to a Ratchet port.","solutions":["If legitimate headers (large cookies/tokens) exceed the limit, raise the parser cap before opening the server: $parser->maxSize = 8192; — access the underlying HttpRequestParser if needed via the WsServer component.","Reduce client-side handshake header size: trim cookies, split large tokens, or pass auth after the connection opens over WAMP messages instead of headers.","Check what is connecting to the port — any non-WebSocket traffic (health checks, port scans, TCP probes) will trip this; route such traffic elsewhere.","Treat the exception as expected in your onError handler: log and close the connection rather than crashing the server."],"exampleFix":"// before\n$wsServer = new Ratchet\\WebSocket\\WsServer($handler); // default 4096-byte header cap\n// after\n$wsServer = new Ratchet\\WebSocket\\WsServer($handler);\n$wsServer->setHttpRequestParserFactory(function () {\n    $parser = new Ratchet\\Http\\HttpRequestParser();\n    $parser->maxSize = 16384; // allow large handshake headers\n    return $parser;\n}); // or otherwise configure maxSize before accepting connections","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// in your implementing component's onError\npublic function onError(ConnectionInterface $conn, \\Exception $e) {\n    if ($e instanceof \\OverflowException) {\n        // oversized/never-terminated HTTP header: log and drop\n        error_log(\"Handshake buffer overflow: \" . $e->getMessage());\n    }\n    $conn->close();\n}","preventionTips":["Keep handshake headers small; move large auth payloads (big cookies/JWTs) out of HTTP headers.","Ensure clients terminate headers with \\r\\n\\r\\n — never write raw TCP to the WebSocket port.","Raise HttpRequestParser->maxSize deliberately if you expect large legitimate headers, and monitor memory.","Always implement onError to close the connection; do not let one bad client destabilize the loop."],"tags":["http","websocket","handshake","buffer-overflow"],"backgroundTag":"payload-too-large","analyzedSha":"e621c6c40bf684bbbb877102416ad5303d05a9cc","analyzedAt":"2026-09-16T00:13:27.878Z","contentChangedAt":"2026-09-16T00:13:27.878Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}