Qlik Sense HTTP Header size restriction

Andre_Sostizzo · Aug 18, 2023 8:06:08 AM

SAML authentication fails with the following error:

HTTP Error 400. The size of the request headers is too long.

The entire return code looks as such:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Bad Request</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Bad Request - Request Too Long</h2>
<hr><p>HTTP Error 400. The size of the request headers is too long.</p>
</BODY></HTML>

Environment:

Qlik Sense Enterprise on Windows any version

Windows and Qlik Sense have a limitation on HTTP Header sizes.

The maximum header length is set at 16 KB.

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

Resolution:

Note: We recommend that you investigate the impact on other programs on the machine, as changing these settings is a system-wide change.

Steps to be applied on the Qlik Sense Server:

Open the Windows Registry Editor with Administrative Permissions.
Create (or locate and change) the following keys and configure them with the desired value:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters\MaxFieldLength (64 - 65534 (64k - 2) bytes)

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters\MaxRequestBytes (256 - 16777216 (16MB) bytes)
Restart the Server
Open the Qlik Sense Management Console
Open the Proxy used and navigate to the Settings of the Proxy
In the Advanced section, input the desired Max header size (bytes)

The HTTP header length can be up to 64kb.

For more information, see Add Session on Qlik Sense for developers.

Ken_T · ‎2021-07-28

We do not see this key in our Feb 2021 version of Qlik Sense. Is this still valid for Feb 2021 and up?

If so, does the key need to be added?

Ken_T · ‎2021-07-28

looks like the key needs to be added manually, per Microsoft.

related to this, can this issue also manifest with a 500 error, instead of the 400 error?

We are seeing 500 error for many users with large number of groups, giving a larger header size.
However, users with small number of groups are not seeing any errors and the SAML works fine for them.

is there any issue with the number of groups that could cause a 500 error instead of a 400 error?

Sonja_Bauernfeind · ‎2021-07-28

Hello @Ken_T

This is a little too complex to troubleshoot with you (or brainstorm) in an article - we'll need an SME for this and I'd suggest logging a ticket if you haven't already done so.

We try to add as much information as we can to our articles to assist in deeper investigations, but sometimes the right question hasn't been asked yet.

-Sonja

Ken_T · ‎2021-08-03

We have tested and proven that we get an HTTP 500 error with SAML when the user has too many groups. This is a close cousin to this error documented on this page, but different. We were getting all the group information in an attribute, memberof. We had to do work with our SAML team to set up a new attribute, that got a smaller set of groups, in a new attribute, in order to workaround this problem.

it appears that Qlik has a limit on the number of groups, we only saw this 500 error when the user was a member of many groups. Users with smaller number of groups, had no error at all and everything worked fine.

This would benefit users, if this error and root cause could be confirmed by Qlik Support and documented. The 500 error is not very informative and we did not see anything in the logs that helped determine the root cause either. it took a while to figure out and find a workaround.

Damien_Villaret · ‎2021-08-09

Hello @Ken_T

I believe your issue is rather related to https://community.qlik.com/t5/Knowledge/Qlik-Sense-quot-Qlik-Sense-G3-Broker-API-quot-error-on-the-h...

To be precise, this is the total length of all groups and not the number of groups itself. Less groups with very long group names would cause the same issue.

That header size can be set as per the above article in C:\Program Files\Qlik\Sense\ServiceDispatcher\service.conf

Ken_T · ‎2021-08-09

Hi @Damien_Villaret , no, I do not think it is the same issue. the error returned are different, and the workarounds for the total header size (with the 400 error) do not affect this issue with too many groups (the generic 500 error). we tested this and established the root cause of the 500 error was the number of groups. The other workarounds we found, including the one in this article, for the header too large issue which gives a 400 error had no effect on the situation we were facing at all. @Sonja_Bauernfeind thanks for your help as always, unfortunately Qlik Support will usually see SAML in the ticket and not assist at all usually, and suggest that professional services be engaged. even if it seems there may be a defect/feature at play.

I do not think we tested the MaxHttpHeaderSize setting but we did try the registry entry listed in this article.

Damien_Villaret · ‎2021-08-09

Hi @Ken_T

Actually for the article I sent, the error was different in different versions (the article probably needs a refresh), in some versions it was "Broker API G3", in some other versions it was an error 500 on any of the Dispatcher service endpoint (/api/v1/language or any other /api/v1/... endpoints, this can be verified in the "network" tab in the browser devtools)

ggijben · ‎2023-06-14

This article mentions that the HTTP header length can reach a maximum of 64kb. However, in the QMC (Proxy), a message indicates that the maximum header size is 131072 bytes, which is equivalent to 128kb.

Can someone clarify this ambiguity?

Max Header Size.png

Sonja_Bauernfeind · ‎2023-06-19

Hello @ggijben

I'll look into this for you. The documentation we have still references 64kb as well (not only this article), so it may be that we will need case to have this run through RnD. But I will check first to see what I can do without a ticket.

All the best,
Sonja

Sonja_Bauernfeind · ‎2023-06-22

Hello @ggijben No ticket is required!

This difference comes from the management console allowing a value it shouldn't. I've reported this as a defect: QB-20272.

All the best,
Sonja

Qlik Sense HTTP Header size restriction