{"record":{"id":"6fa26d22bd95c771","repo":"FlowiseAI/Flowise","slug":"invalid-header-key-value-exceeds-max-value","errorCode":null,"errorMessage":"Invalid header \"${key}\": value exceeds ${MAX_VALUE_LENGTH} chars","messagePattern":"Invalid header \"(.+?)\": value exceeds (.+?) chars","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"packages/components/src/headerValidation.ts","lineNumber":69,"sourceCode":"            throw new Error('Invalid header: key must be a non-empty string')\n        }\n        if (key.length > MAX_KEY_LENGTH) {\n            throw new Error(`Invalid header \"${key}\": key exceeds ${MAX_KEY_LENGTH} chars`)\n        }\n        if (!RFC7230_TOKEN.test(key)) {\n            throw new Error(`Invalid header \"${key}\": key contains illegal characters`)\n        }\n\n        const lower = key.toLowerCase()\n        if (DENIED_HEADER_NAMES.has(lower) || DENIED_HEADER_PREFIXES.some((p) => lower.startsWith(p))) {\n            throw new Error(`Invalid header \"${key}\": this header name is not allowed`)\n        }\n\n        if (typeof value !== 'string') {\n            throw new Error(`Invalid header \"${key}\": value must be a string`)\n        }\n        if (value.length > MAX_VALUE_LENGTH) {\n            throw new Error(`Invalid header \"${key}\": value exceeds ${MAX_VALUE_LENGTH} chars`)\n        }\n        for (let i = 0; i < value.length; i++) {\n            const code = value.charCodeAt(i)\n            if (code === 0x0d || code === 0x0a || (code < 0x20 && code !== 0x09)) {\n                throw new Error(`Invalid header \"${key}\": value contains illegal control characters`)\n            }\n        }\n    }\n}\n\n/**\n * Returns a copy of `headers` with credential-bearing entries (Authorization, Cookie, X-Api-Key, …)\n * replaced by a placeholder string. Used at trust boundaries before a header bag is exposed to flow\n * templates, observers, or logs. Comparison is case-insensitive; non-sensitive headers pass through.\n */\nexport function redactSensitiveHeaders(headers: Record<string, any> | undefined | null): Record<string, any> {\n    if (!headers) return {}\n    const out: Record<string, any> = {}","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/headerValidation.ts#L51-L87","documentation":"Thrown by validateCustomHeaders() when a header value exceeds MAX_VALUE_LENGTH (2048 characters). This guard prevents oversized headers that could destabilize downstream proxies, CDNs, or target servers which impose their own limits. It is a defense against accidental large-payload injection (e.g. embedding entire documents or base64 blobs into a single header).","triggerScenarios":"Passing a header whose value is longer than 2048 chars: a long Bearer/JWT token, a base64-encoded payload, a comma-separated allowlist of IDs, or a copied JSON blob. The check at line 68 (value.length > MAX_VALUE_LENGTH) fires after the type check passes.","commonSituations":"Embedding large auth tokens, passing serialized state objects, or forwarding trace/span context that accumulates. Some OAuth providers issue tokens over 2048 chars. Misconfiguring a metadata header to carry the full request body.","solutions":["Move large data out of headers into the request body or a side-channel store.","Truncate or hash the value if only a fingerprint is needed downstream.","Split the value across multiple custom headers if the downstream consumer supports reassembly.","If a legitimate value must exceed 2048 chars, raise MAX_VALUE_LENGTH in a fork only after confirming all downstream proxies/servers accept the larger size."],"exampleFix":"// before\nvalidateCustomHeaders({ Authorization: 'Bearer ' + hugeJwt })\n\n// after\n// move the token to the body or use a shorter reference token\nvalidateCustomHeaders({ 'X-Auth-Ref': shortReferenceId })","handlingStrategy":"validation","validationCode":"const MAX_VALUE_LENGTH = 2048\nfunction truncateHeaders(headers: Record<string, string>): Record<string, string> {\n  const out: Record<string, string> = {}\n  for (const [k, v] of Object.entries(headers)) {\n    out[k] = v.length > MAX_VALUE_LENGTH ? v.slice(0, MAX_VALUE_LENGTH) : v\n  }\n  return out\n}\nvalidateCustomHeaders(truncateHeaders(headers))","typeGuard":null,"tryCatchPattern":"try {\n  validateCustomHeaders(headers)\n} catch (e) {\n  if (String(e).includes('value exceeds')) {\n    // log and drop or truncate the offending header\n  }\n  throw e\n}","preventionTips":["Keep auth tokens short; use reference tokens instead of raw JWTs in headers.","Move large payloads to the request body.","Set up a lint rule or pre-commit check on config files that define static headers."],"tags":["headers","limits","http","validation"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}