{"record":{"id":"463e833222360638","repo":"TechnitiumSoftware/DnsServer","slug":"dns-over-http-real-ip-header-name-cannot-exceed-25","errorCode":null,"errorMessage":"DNS-over-HTTP Real IP header name cannot exceed 255 characters.","messagePattern":"DNS-over-HTTP Real IP header name cannot exceed 255 characters\\.","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/DnsServer.cs","lineNumber":7841,"sourceCode":"                    _dnsReverseProxyNetworkACL = value;\n            }\n        }\n\n        public string DnsTlsCertificatePath\n        { get { return _dnsTlsCertificatePath; } }\n\n        public string DnsTlsCertificatePassword\n        { get { return _dnsTlsCertificatePassword; } }\n\n        public string DnsOverHttpRealIpHeader\n        {\n            get { return _dnsOverHttpRealIpHeader; }\n            set\n            {\n                if (string.IsNullOrEmpty(value))\n                    _dnsOverHttpRealIpHeader = \"X-Real-IP\";\n                else if (value.Length > 255)\n                    throw new ArgumentException(\"DNS-over-HTTP Real IP header name cannot exceed 255 characters.\", nameof(DnsOverHttpRealIpHeader));\n                else if (value.Contains(' '))\n                    throw new ArgumentException(\"DNS-over-HTTP Real IP header name cannot contain invalid characters.\", nameof(DnsOverHttpRealIpHeader));\n                else\n                    _dnsOverHttpRealIpHeader = value;\n            }\n        }\n\n        public IReadOnlyDictionary<string, TsigKey> TsigKeys\n        {\n            get { return _tsigKeys; }\n            set\n            {\n                if ((value is null) || (value.Count == 0))\n                    _tsigKeys = null;\n                else if (value.Count > byte.MaxValue)\n                    throw new ArgumentOutOfRangeException(nameof(TsigKeys), \"TSIG keys cannot have more than 255 entries.\");\n                else\n                    _tsigKeys = value;","sourceCodeStart":7823,"sourceCodeEnd":7859,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/DnsServer.cs#L7823-L7859","documentation":"Thrown by the DnsOverHttpRealIpHeader property setter when the supplied header name exceeds 255 characters. The library uses this header name (default \"X-Real-IP\") to read the originating client IP from a reverse-proxy DoH request, and 255 is the practical maximum length for an HTTP header field name token. Passing an over-long string is treated as a configuration error rather than silently truncating it.","triggerScenarios":"Setting DnsServer.DnsOverHttpRealIpHeader to any non-empty string whose Length > 255. This commonly happens when a developer accidentally assigns the header VALUE (e.g. a full IP list or a long proxy chain string) into the NAME field, or pastes a multi-header config blob.","commonSituations":"Confusing the header name with its value; copy-pasting an entire nginx/apache config line; feeding a JSON/concatenated set of forwarded headers into a single property; migrating from a proxy that exposes a composite header.","solutions":["Pass a single, well-formed header name such as \"X-Real-IP\" or \"X-Forwarded-For\" that is far under 255 chars.","If you only need the default behavior, set the property to null or empty string so it auto-defaults to \"X-Real-IP\".","Double-check you are assigning the header NAME, not the resolved client IP or a list of headers."],"exampleFix":"// before\nserver.DnsOverHttpRealIpHeader = \"203.0.113.5, 198.51.100.2\"; // accidentally assigned a value\n\n// after\nserver.DnsOverHttpRealIpHeader = \"X-Real-IP\";","handlingStrategy":"validation","validationCode":"static string SanitizeRealIpHeader(string value)\n{\n    if (string.IsNullOrEmpty(value)) return null; // let the setter apply its default\n    if (value.Length > 255)\n        throw new InvalidOperationException(\"DoH real-IP header name must be <= 255 characters.\");\n    return value;\n}\n\nserver.DnsOverHttpRealIpHeader = SanitizeRealIpHeader(configHeader);","typeGuard":"static bool IsValidRealIpHeader(string value) =>\n    string.IsNullOrEmpty(value) || (value.Length <= 255 && !value.Contains(' '));","tryCatchPattern":"try { server.DnsOverHttpRealIpHeader = headerName; }\ncatch (ArgumentException ex) when (ex.ParamName == nameof(server.DnsOverHttpRealIpHeader))\n{\n    logger.Warn(\"Invalid DoH real-IP header name; falling back to default.\");\n    server.DnsOverHttpRealIpHeader = null; // triggers built-in default\n}","preventionTips":["Treat the property as a header NAME (token), never a header value or IP list.","Source all such config from a validated settings object, not raw strings.","When in doubt, leave the property unset to use the built-in default."],"tags":["dns","configuration","validation","doh","http-header"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}