txthinking/brook · error

HTTP header too long

Error message

HTTP header too long

What it means

The SOCKS5-to-HTTP bridge reads the client's HTTP request header byte-by-byte until it sees the CRLFCRLF terminator, but aborts if the accumulated header reaches 2083+18 (2101) bytes. This enforces a practical bound on HTTP request-line/header size before parsing. It protects the parser from unbounded memory growth on never-terminated or hostile input.

Source

Thrown at socks5tohttp.go:108

			}
		}(c)
	}
}

func (s *Socks5ToHTTP) Handle(c *net.TCPConn) error {
	b := make([]byte, 0, 1024)
	for {
		var b1 [1024]byte
		n, err := c.Read(b1[:])
		if err != nil {
			return err
		}
		b = append(b, b1[:n]...)
		if bytes.Contains(b, []byte{0x0d, 0x0a, 0x0d, 0x0a}) {
			break
		}
		if len(b) >= 2083+18 {
			return errors.New("HTTP header too long")
		}
	}

	bb := bytes.SplitN(b, []byte(" "), 3)
	if len(bb) != 3 {
		return errors.New("Invalid Request")
	}
	method, address := string(bb[0]), string(bb[1])
	var addr string
	if method == "CONNECT" {
		addr = address
	}
	if method != "CONNECT" {
		var err error
		addr, err = GetAddressFromURL(address)
		if err != nil {
			return err
		}

View on GitHub (pinned to 5cd13ef3b1)

Solutions

1. Shorten the request URL and headers (e.g. trim query strings, cookies) to keep the header under ~2101 bytes
2. Ensure the client terminates headers with a proper CRLFCRLF sequence
3. Verify the client actually speaks HTTP/1.x with CRLF line endings
4. If long URLs are unavoidable, route them without this proxy or use a variant with a larger header limit

Example fix

// before: 4KB Cookie header causes the limit to trip
req.Header.Set("Cookie", giantCookie)

// after: send only the needed cookie
req.Header.Set("Cookie", essentialCookie)

func headerFits(req *http.Request) bool {
	var n int
	for k, v := range req.Header {
		n += len(k) + len(v[0]) + 4
	}
	return n+len(req.URL.String()) < 2083
}

When it happens

Trigger: Handle() reads from the client and the buffered bytes reach 2101 bytes without containing '\r\n\r\n'; typically an HTTP request with an extremely long URL/query string, huge Cookie headers, or a client that never terminates the header block.

Common situations: Browsers or clients putting very long tokens/URLs (>2KB request line) through the proxy; a non-HTTP client speaking garbage that never emits CRLFCRLF; a client sending headers with bare LF line endings that the CRLFCRLF check misses.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

• Invalid Request
• string(b)
• err.Error()

AI-assisted analysis of txthinking/brook@5cd13ef3b1 (2026-09-06). Data as JSON: /api/errors/ca42eb463271b030. Report an issue: GitHub.