Configuring Tomcat for Extremely Long URLs: Maximum Length Limits and Query Parameter Handling


15 views

By default, Apache Tomcat imposes an 8KB (8192 bytes) limit on the entire URL including query parameters. This restriction comes from the HTTP connector's maxHttpHeaderSize attribute in server.xml:


<Connector port="8080" protocol="HTTP/1.1" 
           maxHttpHeaderSize="8192" 
           ... />

To handle URLs with 200K query parameters (as mentioned in the question), you'll need to modify several Tomcat configurations:


<Connector port="8080" protocol="HTTP/1.1"
           maxHttpHeaderSize="209715200"  <!-- 200MB -->
           maxParameterCount="10000"      <!-- Increase if needed -->
           relaxedQueryChars="[]|{}^\\"<>" 
           relaxedPathChars="[]|" 
           URIEncoding="UTF-8" />

maxHttpHeaderSize: Sets the maximum size of the request header (including URL) in bytes. For 200K params, set to at least 209715200.

maxParameterCount: Controls the maximum number of parameters Tomcat will parse. Default is 10000.

relaxedQueryChars/relaxedPathChars: Allow special characters in URLs that would normally be rejected.

While technically possible to handle extremely long URLs, consider these factors:

  • Browser limitations (most have ~2KB URL limits)
  • Proxy server restrictions
  • Performance impact of parsing large URLs
  • Security implications of large headers

For search applications requiring GET requests, consider URL shortening techniques:


// Client-side compression example
function compressParams(params) {
  return LZString.compressToEncodedURIComponent(JSON.stringify(params));
}

// Server-side handling
protected void doGet(HttpServletRequest request, HttpServletResponse response) {
  String compressed = request.getParameter("q");
  String decompressed = LZString.decompressFromEncodedURIComponent(compressed);
  // Process decompressed parameters
}

This approach maintains GET semantics while reducing URL length significantly.

Verify your settings with a simple test servlet:


@WebServlet("/test")
public class TestServlet extends HttpServlet {
    protected void doGet(HttpServletRequest request, HttpServletResponse response) 
      throws ServletException, IOException {
        response.getWriter().print(
          "Parameter count: " + request.getParameterMap().size() + "\n" +
          "Query string length: " + (request.getQueryString() != null ? 
              request.getQueryString().length() : 0)
        );
    }
}

Apache Tomcat enforces a default maximum URL length of 8KB (8192 bytes) including both the path and query parameters. This limitation exists in the HTTP connector configuration and serves as a protective measure against potential denial-of-service attacks.


// Default setting in Tomcat's server.xml
<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443"
           maxHttpHeaderSize="8192" />

To handle larger URLs (like your 200KB requirement), you'll need to modify Tomcat's configuration:


<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443"
           maxHttpHeaderSize="204800" />

Key points about this configuration:

  • The maxHttpHeaderSize parameter controls the maximum size of the HTTP request header
  • Value is specified in bytes (204800 = 200KB)
  • Requires Tomcat restart to take effect

Increasing this limit has several implications:


// Example of checking URL length in a servlet
protected void doGet(HttpServletRequest request, HttpServletResponse response) {
    String queryString = request.getQueryString();
    if (queryString != null && queryString.length() > 200000) {
        response.sendError(HttpServletResponse.SC_REQUEST_URI_TOO_LONG);
        return;
    }
    // Process the request...
}

While configuring Tomcat works, consider these alternatives for better architecture:


// Using POST with hidden form field for search parameters
<form action="/search" method="POST">
    <input type="hidden" name="query" value="[very long search string]">
    <button type="submit">Search</button>
</form>

For systems where you must use GET, consider implementing client-side compression of parameters before sending to the server.

Large URLs affect:

  • Memory usage in Tomcat
  • Network transmission time
  • Potential for buffer overflow attacks
  • Log file sizes (as URLs are typically logged)