ratchetphp/Ratchet · error · OverflowException

Maximum buffer size of

Error message

Maximum buffer size of {$this->maxSize} exceeded parsing HTTP header

What it means

HttpRequestParser::onMessage accumulates incoming bytes in $context->httpBuffer until a complete HTTP header (terminated by \r\n\r\n) arrives. If the accumulated buffer exceeds $this->maxSize (default 4096 bytes) before the header terminates, it throws OverflowException — defending against clients that never finish the handshake or deliberately flood the server with header data.

Solutions

If legitimate headers (large cookies/tokens) exceed the limit, raise the parser cap before opening the server: $parser->maxSize = 8192; — access the underlying HttpRequestParser if needed via the WsServer component.
Reduce client-side handshake header size: trim cookies, split large tokens, or pass auth after the connection opens over WAMP messages instead of headers.
Check what is connecting to the port — any non-WebSocket traffic (health checks, port scans, TCP probes) will trip this; route such traffic elsewhere.
Treat the exception as expected in your onError handler: log and close the connection rather than crashing the server.

Example fix

// before
$wsServer = new Ratchet\WebSocket\WsServer($handler); // default 4096-byte header cap
// after
$wsServer = new Ratchet\WebSocket\WsServer($handler);
$wsServer->setHttpRequestParserFactory(function () {
    $parser = new Ratchet\Http\HttpRequestParser();
    $parser->maxSize = 16384; // allow large handshake headers
    return $parser;
}); // or otherwise configure maxSize before accepting connections

Defensive patterns

Strategy: try-catch

Try / catch

// in your implementing component's onError
public function onError(ConnectionInterface $conn, \Exception $e) {
    if ($e instanceof \OverflowException) {
        // oversized/never-terminated HTTP header: log and drop
        error_log("Handshake buffer overflow: " . $e->getMessage());
    }
    $conn->close();
}

Prevention

Keep handshake headers small; move large auth payloads (big cookies/JWTs) out of HTTP headers.
Ensure clients terminate headers with \r\n\r\n — never write raw TCP to the WebSocket port.
Raise HttpRequestParser->maxSize deliberately if you expect large legitimate headers, and monitor memory.
Always implement onError to close the connection; do not let one bad client destabilize the loop.

When it happens

Trigger: A client opens a TCP connection to the WebSocket port and streams more than maxSize bytes without sending the \r\n\r\n header terminator; sending one gigantic Cookie or header block larger than the limit; a raw TCP client or port scanner writing arbitrary bytes.

Common situations: Sending very large authentication cookies or JWTs in headers during the handshake on servers behind proxies that append extra headers; a misconfigured client that omits the blank line terminating the HTTP header; attackers flooding sockets (this guard is the mitigation — tighten or widen deliberately); proxying non-HTTP protocols to a Ratchet port.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

AI-assisted analysis of ratchetphp/Ratchet@e621c6c40b (2026-09-16). Data as JSON: /api/errors/28169aac7b6ddde5. Report an issue: GitHub.

Appendix: source

Thrown at src/Ratchet/Http/HttpRequestParser.php:36

     * @var int
     */
    public $maxSize = 4096;

    /**
     * @param \Ratchet\ConnectionInterface $context
     * @param string                       $data Data stream to buffer
     * @return \Psr\Http\Message\RequestInterface
     * @throws \OverflowException If the message buffer has become too large
     */
    public function onMessage(ConnectionInterface $context, $data) {
        if (!isset($context->httpBuffer)) {
            $context->httpBuffer = '';
        }

        $context->httpBuffer .= $data;

        if (strlen($context->httpBuffer) > (int)$this->maxSize) {
            throw new \OverflowException("Maximum buffer size of {$this->maxSize} exceeded parsing HTTP header");
        }

        if ($this->isEom($context->httpBuffer)) {
            $request = $this->parse($context->httpBuffer);

            unset($context->httpBuffer);

            return $request;
        }
    }

    /**
     * Determine if the message has been buffered as per the HTTP specification
     * @param  string  $message
     * @return boolean
     */
    public function isEom($message) {
        return strpos($message, static::EOM) !== false;

View on GitHub (pinned to e621c6c40b)