fix(backend): update request size limits for improved header handling

Signed-off-by: Noste <83548733+Noooste@users.noreply.github.com>

backend/main.go

@@ -163,14 +163,7 @@ func main() {
 	if maxBodySize == 0 {
 		maxBodySize = 300 * 1024 * 1024 // 300MB default
 	}
-	maxHeaderSize := cfg.Server.MaxHeaderSize
+	readBufferSize := resolveReadBufferSize(cfg.Server.ReadBufferSize, cfg.Server.MaxHeaderSize)
-	if maxHeaderSize == 0 {
-		maxHeaderSize = 1 * 1024 * 1024 // 1MB default
-	}
-	readBufferSize := cfg.Server.ReadBufferSize
-	if readBufferSize == 0 {
-		readBufferSize = 4096 // 4KB default
-	}
 	writeBufferSize := cfg.Server.WriteBufferSize
 	if writeBufferSize == 0 {
 		writeBufferSize = 4096 // 4KB default
@@ -179,8 +172,8 @@ func main() {
 	logger.Info().
 		Int64("max_body_bytes", maxBodySize).
 		Float64("max_body_mb", float64(maxBodySize)/(1024*1024)).
-		Int("max_header_bytes", maxHeaderSize).
+		Int("max_header_bytes", readBufferSize).
-		Float64("max_header_kb", float64(maxHeaderSize)/1024).
+		Float64("max_header_kb", float64(readBufferSize)/1024).
 		Msg("Server request limits configured")
 
 	// Create Fiber app with configuration
@@ -260,6 +253,22 @@ func main() {
 		Msg("Server stopped gracefully")
 }
 
+// Sized to fit the identity headers auth proxies forward upstream.
+const defaultReadBufferSize = 32 * 1024
+
+// resolveReadBufferSize returns the read buffer size to hand to Fiber. fasthttp
+// caps request headers by the read buffer, so max_header_size only takes effect
+// through it.
+func resolveReadBufferSize(readBufferSize, maxHeaderSize int) int {
+	if readBufferSize <= 0 {
+		readBufferSize = defaultReadBufferSize
+	}
+	if maxHeaderSize > readBufferSize {
+		return maxHeaderSize
+	}
+	return readBufferSize
+}
+
 // customErrorHandler handles errors globally. It uses the per-request logger
 // from c.Context() so request_id / user_id attach automatically, and it
 // demotes expected 4xx responses to warn (5xx stays at error).

config.example.yaml

@@ -11,8 +11,8 @@ server:
 
   # Request size limits (in bytes)
   max_body_size: 314572800 # 300MB - Maximum request body size (increase for large file uploads)
-  max_header_size: 1048576 # 1MB - Maximum request header size
+  max_header_size: 32768 # 32KB - raise if an auth proxy's headers cause HTTP 431
-  read_buffer_size: 4096 # 4KB - Read buffer size
+  read_buffer_size: 32768 # 32KB - Read buffer; also caps total header size
   write_buffer_size: 4096 # 4KB - Write buffer size
 
 # Garage S3 Configuration

helm/garage-ui/values.yaml

@@ -51,8 +51,8 @@ config:
     root_url: "https://garage-ui.example.com"
     # Request size limits (in bytes)
     max_body_size: 314572800  # 300MB
-    max_header_size: 1048576  # 1MB
+    max_header_size: 32768    # 32KB - raise if an auth proxy's headers cause HTTP 431
-    read_buffer_size: 4096    # 4KB
+    read_buffer_size: 32768   # 32KB - also caps total header size
     write_buffer_size: 4096   # 4KB
 
   garage: