How to Fix “Request Header Field Exceeds Server Limit” by Increasing Apache’s LimitRequestFieldSize


72 views

When working with modern web applications that rely heavily on client-side JavaScript frameworks and plugins, you might encounter the frustrating error:

Your browser sent a request that this server could not understand. 
Size of a request header field exceeds server limit.

This occurs because Apache HTTP Server has a default LimitRequestFieldSize of 8190 bytes (8KB) for individual header fields. When your application uses plugins that store large amounts of data in cookies or custom headers, you can easily hit this limit.

The most reliable places to set this directive are:

  1. Main Apache Configuration (recommended for production):
  2. # In httpd.conf or apache2.conf
    LimitRequestFieldSize 16380
  3. Virtual Host Configuration:
  4. <VirtualHost *:80>
        ServerName example.com
        LimitRequestFieldSize 32760
        # Other directives...
    </VirtualHost>

Important Note: While .htaccess files can theoretically accept this directive, many shared hosting providers disable this for security reasons. The directive must appear in a context where AllowOverride Limit is enabled.

After making changes, verify they're active:

# For Mac/Linux:
apachectl -t -D DUMP_RUN_CFG | grep LimitRequestFieldSize

# Alternative method:
curl -I localhost | grep -i 'limit'

If you can't modify server settings, consider these approaches:

// JavaScript solution - reduce cookie size
document.cookie = "compressedData=" + LZString.compressToUTF16(JSON.stringify(data));

// PHP solution - split large cookies
$chunks = str_split($large_data, 4000);
foreach ($chunks as $i => $chunk) {
    setcookie("data_$i", $chunk, time()+3600, '/');
}

While increasing LimitRequestFieldSize solves immediate problems, be aware that:

  • Larger headers increase memory usage per connection
  • May impact performance under heavy load
  • Could expose you to potential DoS attacks

The sweet spot is typically between 16KB-32KB for most applications. Monitor your server's performance after making changes.

If changes don't take effect:

  1. Check for multiple LimitRequestFieldSize directives (last one wins)
  2. Ensure you're editing the correct httpd.conf (MAMP uses custom paths)
  3. Verify syntax with apachectl configtest
  4. Check error logs: tail -f /var/log/apache2/error.log

For MAMP PRO users on macOS, the configuration path is typically:
/Applications/MAMP/conf/apache/httpd.conf


When working with jQuery plugins or modern web applications that rely heavily on cookie-based sessions, you might encounter this frustrating Apache error:

Your browser sent a request that this server could not understand. 
Size of a request header field exceeds server limit.

The LimitRequestFieldSize directive is one of those rare Apache configurations that cannot be set in .htaccess files. This is because it's considered a server security and performance setting that should be managed at the server configuration level.

For MAMP users on Mac OSX, you'll need to modify the main Apache configuration file. Here's the typical path:

/Applications/MAMP/conf/apache/httpd.conf

Open httpd.conf and search for "LimitRequestFieldSize". If it exists, modify the value. If not, add this line in the main configuration section:

# Set maximum request header field size to 16KB
LimitRequestFieldSize 16380

For enterprise applications with very large cookies, you might need even higher values:

# Extreme case for complex SSO implementations
LimitRequestFieldSize 32760

Remember that increasing this value affects server performance and memory usage. Always:

  • Restart Apache after making changes
  • Consider optimizing your cookie usage if possible
  • Monitor server performance after increasing the limit

After restarting Apache, you can verify the new setting is active by creating a PHP test file:

<?php
// Output all Apache directives
print_r(apache_get_modules());
print_r(apache_get_configuration());
?>

Or check from terminal:

apachectl -t -D DUMP_CONFIG | grep LimitRequestFieldSize

If you can't modify the main Apache config (e.g., in shared hosting), consider:

  1. Reducing cookie size by storing only essential data
  2. Using session storage instead of cookies where possible
  3. Implementing token-based authentication with smaller headers