mihomo-party-org/clash-party · error
Request headers too large
Error message
Request headers too large
What it means
validateHeaders() enforces limits before sending: at most MAX_HEADERS entries per request. Exceeding the count throws 'Request headers too large' — a guard keeping outgoing requests small and predictable for the gateway/proxy chain.
Source
Thrown at src/main/resolve/plugin/http-client.ts:32
// 走代理时由代理负责解析/连接目标,本地 SSRF guarded lookup 不再适用(安全保证降级)
proxy?: { host: string; port: number }
}
export interface PluginResponse {
status: number
headers: http.IncomingHttpHeaders
body: string
}
const FORBIDDEN_HEADERS = new Set(['host', 'content-length', 'connection', 'transfer-encoding'])
const MAX_HEADERS = 32
const MAX_HEADER_NAME_LEN = 128
const MAX_HEADER_VALUE_LEN = 4096
const MAX_HEADER_BYTES = 16 * 1024
function validateHeaders(input: Record<string, string>): Record<string, string> {
const entries = Object.entries(input)
if (entries.length > MAX_HEADERS) throw new Error('Request headers too large')
const headers: Record<string, string> = {}
let total = 0
for (const [k, v] of entries) {
if (FORBIDDEN_HEADERS.has(k.toLowerCase())) {
throw new Error(`Forbidden header: ${k}`)
}
const nameBytes = Buffer.byteLength(k, 'utf-8')
const valueBytes = Buffer.byteLength(v, 'utf-8')
if (nameBytes > MAX_HEADER_NAME_LEN || valueBytes > MAX_HEADER_VALUE_LEN) {
throw new Error('Request headers too large')
}
total += nameBytes + valueBytes
headers[k] = v
}
if (total > MAX_HEADER_BYTES) throw new Error('Request headers too large')
return headers
}View on GitHub (pinned to 911e090537)
Solutions
- Trim the header set to only what the gateway requires.
- Deduplicate/merge headers before calling — many come from default header sets.
- Move bulk data into the request body instead of headers.
Example fix
// before
headers: { ...incomingHeaders, ...defaultHeaders } // may exceed MAX_HEADERS
// after
const allowed = ['content-type', 'accept', 'user-agent']
const headers = Object.fromEntries(
Object.entries(incomingHeaders).filter(([k]) => allowed.includes(k.toLowerCase()))
) Defensive patterns
Strategy: validation
Validate before calling
const MAX_HEADERS = 16
if (Object.keys(headers).length > MAX_HEADERS) {
throw new Error(`Too many headers: ${Object.keys(headers).length} > ${MAX_HEADERS}`)
} Try / catch
try {
return await request(url, { headers })
} catch (e) {
if ((e as Error).message === 'Request headers too large') {
// rebuild a minimal header set and retry once
} else throw e
} Prevention
- Whitelist only the headers you need instead of forwarding everything.
- Avoid repeated spread-merging of default header objects that accumulate entries.
- Centralize header construction so limits are checked in one place.
When it happens
Trigger: Calling the HTTP client (via requestOnce) with a headers record containing more than MAX_HEADERS entries (e.g. >16 headers).
Common situations: Programmatically forwarding all incoming request headers, merging default headers repeatedly so they accumulate, or signing code that adds many metadata headers.
Related errors
- Forbidden header: ${k}
- Subscription failed: Profile missing proxies or providers
- Empty URL
- Unsupported ruleset behavior: ${behavior}
- Invalid core path: directory traversal detected
AI-assisted analysis of mihomo-party-org/clash-party@911e090537 (2026-08-30).
Data as JSON: /api/errors/e09d16b6f9705fee.
Report an issue: GitHub.