{"record":{"id":"ed840eccae329449","repo":"FlowiseAI/Flowise","slug":"invalid-header-key-key-exceeds-max-key-len","errorCode":null,"errorMessage":"Invalid header \"${key}\": key exceeds ${MAX_KEY_LENGTH} chars","messagePattern":"Invalid header \"(.+?)\": key exceeds (.+?) chars","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/headerValidation.ts","lineNumber":54,"sourceCode":" * sensitive header names, and oversized payloads. Throws a plain Error; callers\n * are responsible for mapping to their own error types.\n */\nexport function validateCustomHeaders(headers: Record<string, string>): void {\n    if (!headers || typeof headers !== 'object') {\n        throw new Error('Invalid headers: expected an object')\n    }\n\n    const entries = Object.entries(headers)\n    if (entries.length > MAX_HEADERS) {\n        throw new Error(`Invalid headers: too many entries (max ${MAX_HEADERS})`)\n    }\n\n    for (const [key, value] of entries) {\n        if (typeof key !== 'string' || key.length === 0) {\n            throw new Error('Invalid header: key must be a non-empty string')\n        }\n        if (key.length > MAX_KEY_LENGTH) {\n            throw new Error(`Invalid header \"${key}\": key exceeds ${MAX_KEY_LENGTH} chars`)\n        }\n        if (!RFC7230_TOKEN.test(key)) {\n            throw new Error(`Invalid header \"${key}\": key contains illegal characters`)\n        }\n\n        const lower = key.toLowerCase()\n        if (DENIED_HEADER_NAMES.has(lower) || DENIED_HEADER_PREFIXES.some((p) => lower.startsWith(p))) {\n            throw new Error(`Invalid header \"${key}\": this header name is not allowed`)\n        }\n\n        if (typeof value !== 'string') {\n            throw new Error(`Invalid header \"${key}\": value must be a string`)\n        }\n        if (value.length > MAX_VALUE_LENGTH) {\n            throw new Error(`Invalid header \"${key}\": value exceeds ${MAX_VALUE_LENGTH} chars`)\n        }\n        for (let i = 0; i < value.length; i++) {\n            const code = value.charCodeAt(i)","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/headerValidation.ts#L36-L72","documentation":"Per-entry guard: each key must be at most MAX_KEY_LENGTH (128) characters. Header names longer than 128 chars are rejected.","triggerScenarios":"Header bag contains a name longer than 128 characters.","commonSituations":"Key/value swap — a long value (token, URL) accidentally placed as the key; a generated/internal pseudo-header name that grew pathologically long; a pasted blob used as the name.","solutions":["Shorten the header name to <=128 chars.","If you have a long token/URL, it belongs in the VALUE, not the key.","Check for accidental key/value inversion at the caller."],"exampleFix":"// before\nvalidateCustomHeaders({ 'Bearer eyJhbGc...very-long-jwt...': '' }) // key/value swapped -> throws\n\n// after\nvalidateCustomHeaders({ 'Authorization': 'Bearer eyJhbGc...very-long-jwt...' })","handlingStrategy":"validation","validationCode":"// Reject over-long keys before validation\nconst MAX_KEY_LENGTH = 128\nfunction dropOversizedKeys(headers) {\n    return Object.fromEntries(Object.entries(headers).filter(([k]) => typeof k === 'string' && k.length <= MAX_KEY_LENGTH))\n}","typeGuard":"function keysWithinLength(headers, max = 128) {\n    return Object.keys(headers).every((k) => typeof k === 'string' && k.length <= max)\n}","tryCatchPattern":"try {\n    validateCustomHeaders(headers)\n} catch (e) {\n    if (/key exceeds.*chars/i.test(e.message)) {\n        // flag the offending key to the user (its name is in the message)\n    }\n    throw e\n}","preventionTips":["Treat a >128-char key as a likely key/value swap — long tokens belong in values.","Validate header-name length at the form boundary.","Log the offending key name (it is non-sensitive) so users can find it."],"tags":["headers","validation","limits","http"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}