{"record":{"id":"664f74310596697b","repo":"alibaba/Sentinel","slug":"request-body-is-too-big-limit-size-is-4194304","errorCode":null,"errorMessage":"Request body is too big, limit size is 4194304","messagePattern":"Request body is too big, limit size is 4194304","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"sentinel-transport/sentinel-transport-simple-http/src/main/java/com/alibaba/csp/sentinel/transport/heartbeat/client/SimpleHttpResponseParser.java","lineNumber":102,"sourceCode":"                            //When the `Content-Length` is absent, parse the rest of the bytes as body directly.\n                            //if (contentLength == -1) {\n                            //    contentLength = MAX_BODY_SIZE;\n                            //}\n\n                            // Parse HTTP body.\n                            // When the `Content-Length` is absent, drop the body, return directly.\n                            response = new SimpleHttpResponse(statusLine, headers);\n                            if (contentLength <= 0) {\n                                return response;\n                            }\n                            ByteArrayOutputStream out = new ByteArrayOutputStream(1024);\n                            // `Content-Length` is not equal to exact length.\n                            if (contentLength < len - parseBg) {\n                                throw new IllegalStateException(\"Invalid content length: \" + contentLength);\n                            }\n                            out.write(buf, parseBg, len - parseBg);\n                            if (out.size() > MAX_BODY_SIZE) {\n                                throw new IllegalStateException(\n                                    \"Request body is too big, limit size is \" + MAX_BODY_SIZE);\n                            }\n                            int cap = Math.min(contentLength - out.size(), buf.length);\n                            while (cap > 0 && (len = in.read(buf, 0, cap)) > 0) {\n                                out.write(buf, 0, len);\n                                cap = Math.min(contentLength - out.size(), buf.length);\n                            }\n                            response.setBody(out.toByteArray());\n                            return response;\n                        } else if (!line.trim().isEmpty()) {\n                            // Parse HTTP header.\n                            int idx2 = line.indexOf(\":\");\n                            String key = line.substring(0, idx2).trim();\n                            String value = line.substring(idx2 + 1).trim();\n                            headers.put(key, value);\n                            if (\"Content-Length\".equalsIgnoreCase(key)) {\n                                contentLength = Integer.parseInt(value);\n                            }","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/alibaba/Sentinel/blob/a3f40ba8e900c8489bd520274739f17235a7721c/sentinel-transport/sentinel-transport-simple-http/src/main/java/com/alibaba/csp/sentinel/transport/heartbeat/client/SimpleHttpResponseParser.java#L84-L120","documentation":"SimpleHttpResponseParser enforces a hard cap on response body size, MAX_BODY_SIZE = 4 * 1024 * 1024 (4194304 bytes). After writing buffered body bytes (and while streaming the remainder) it checks out.size() > MAX_BODY_SIZE and throws IllegalStateException(\"Request body is too big, limit size is 4194304\"). This protects the heartbeat client's memory from unbounded responses.","triggerScenarios":"The HTTP endpoint the simple-http transport calls (normally the dashboard heartbeat receiver) returning a body larger than 4 MB — e.g. a misrouted URL that now returns a big page/JSON, or a dashboard endpoint whose response grew past the cap.","commonSituations":"Wrong dashboard URL configured (csp.sentinel.dashboard.acapi / heartbeat URL pointing at an endpoint that returns large content); a reverse proxy serving an error page or full report instead of the small heartbeat ack; environment promotion where the URL now resolves to a different service.","solutions":["Verify the heartbeat/dashboard URL configuration points at the real Sentinel dashboard receiver that returns a short ack","Check what the configured URL actually returns (curl -s <url> | wc -c); large output means wrong endpoint or proxy interception","Fix the server to keep heartbeat/command responses small; 4 MB is generous for the intended ack payloads"],"exampleFix":"# before: heartbeat URL points at a data endpoint returning >4MB\ncurl -s http://ops.example.com/api/metrics/all | wc -c   # 30000000\n\n# after: point at the dashboard heartbeat receiver\ncurl -s http://dashboard:8080/api/registry/machine | wc -c   # small ack","handlingStrategy":"validation","validationCode":"// verify the target endpoint returns a small ack before wiring heartbeat\nURLConnection c = new URL(heartbeatUrl).openConnection();\nlong len = c.getContentLengthLong();\nif (len > 4 * 1024 * 1024) {\n    throw new IllegalStateException(\"endpoint body exceeds 4MB parser limit: \" + heartbeatUrl);\n}","typeGuard":null,"tryCatchPattern":"try {\n    response = parser.parse(in);\n} catch (IllegalStateException e) { // 'Request body is too big'\n    // wrong endpoint or proxy interference; fail loudly with the URL for diagnosis\n    throw new IllegalStateException(\"Oversized response from \" + url + \"; check dashboard config\", e);\n}","preventionTips":["Point heartbeat URLs only at the dashboard receiver returning short acks","curl-check configured URLs for accidental large payloads after environment changes"],"tags":["sentinel","transport","http","payload-limit","simple-http"],"backgroundTag":null,"analyzedSha":"a3f40ba8e900c8489bd520274739f17235a7721c","analyzedAt":"2026-08-14T11:10:30.678Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}