Configuring Tomcat for Extremely Long URLs: Maximum Length Limits and Query Parameter Handling


2 views

By default, Apache Tomcat imposes an 8KB (8192 bytes) limit on the entire URL including query parameters. This restriction comes from the HTTP connector's maxHttpHeaderSize attribute in server.xml:


<Connector port="8080" protocol="HTTP/1.1" 
           maxHttpHeaderSize="8192" 
           ... />

To handle URLs with 200K query parameters (as mentioned in the question), you'll need to modify several Tomcat configurations:


<Connector port="8080" protocol="HTTP/1.1"
           maxHttpHeaderSize="209715200"  <!-- 200MB -->
           maxParameterCount="10000"      <!-- Increase if needed -->
           relaxedQueryChars="[]|{}^\\"<>" 
           relaxedPathChars="[]|" 
           URIEncoding="UTF-8" />

maxHttpHeaderSize: Sets the maximum size of the request header (including URL) in bytes. For 200K params, set to at least 209715200.

maxParameterCount: Controls the maximum number of parameters Tomcat will parse. Default is 10000.

relaxedQueryChars/relaxedPathChars: Allow special characters in URLs that would normally be rejected.

While technically possible to handle extremely long URLs, consider these factors:

  • Browser limitations (most have ~2KB URL limits)
  • Proxy server restrictions
  • Performance impact of parsing large URLs
  • Security implications of large headers

For search applications requiring GET requests, consider URL shortening techniques:


// Client-side compression example
function compressParams(params) {
  return LZString.compressToEncodedURIComponent(JSON.stringify(params));
}

// Server-side handling
protected void doGet(HttpServletRequest request, HttpServletResponse response) {
  String compressed = request.getParameter("q");
  String decompressed = LZString.decompressFromEncodedURIComponent(compressed);
  // Process decompressed parameters
}

This approach maintains GET semantics while reducing URL length significantly.

Verify your settings with a simple test servlet:


@WebServlet("/test")
public class TestServlet extends HttpServlet {
    protected void doGet(HttpServletRequest request, HttpServletResponse response) 
      throws ServletException, IOException {
        response.getWriter().print(
          "Parameter count: " + request.getParameterMap().size() + "\n" +
          "Query string length: " + (request.getQueryString() != null ? 
              request.getQueryString().length() : 0)
        );
    }
}

Apache Tomcat enforces a default maximum URL length of 8KB (8192 bytes) including both the path and query parameters. This limitation exists in the HTTP connector configuration and serves as a protective measure against potential denial-of-service attacks.


// Default setting in Tomcat's server.xml
<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443"
           maxHttpHeaderSize="8192" />

To handle larger URLs (like your 200KB requirement), you'll need to modify Tomcat's configuration:


<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443"
           maxHttpHeaderSize="204800" />

Key points about this configuration:

  • The maxHttpHeaderSize parameter controls the maximum size of the HTTP request header
  • Value is specified in bytes (204800 = 200KB)
  • Requires Tomcat restart to take effect

Increasing this limit has several implications:


// Example of checking URL length in a servlet
protected void doGet(HttpServletRequest request, HttpServletResponse response) {
    String queryString = request.getQueryString();
    if (queryString != null && queryString.length() > 200000) {
        response.sendError(HttpServletResponse.SC_REQUEST_URI_TOO_LONG);
        return;
    }
    // Process the request...
}

While configuring Tomcat works, consider these alternatives for better architecture:


// Using POST with hidden form field for search parameters
<form action="/search" method="POST">
    <input type="hidden" name="query" value="[very long search string]">
    <button type="submit">Search</button>
</form>

For systems where you must use GET, consider implementing client-side compression of parameters before sending to the server.

Large URLs affect:

  • Memory usage in Tomcat
  • Network transmission time
  • Potential for buffer overflow attacks
  • Log file sizes (as URLs are typically logged)