414 - URI Too Long

1// Bad: Large data in URL (may cause 414)
2const filters = {
3  tags: ['tag1', 'tag2', 'tag3', /* ... 100 more tags ... */],
4  categories: ['cat1', 'cat2', /* ... 50 more ... */],
5  dateRange: { start: '2020-01-01', end: '2024-01-01' },
6};
7
8const params = new URLSearchParams();
9Object.entries(filters).forEach(([key, value]) => {
10  if (Array.isArray(value)) {
11    value.forEach(v => params.append(key, v));
12  } else {
13    params.append(key, JSON.stringify(value));
14  }
15});
16
17// This URL will be very long and may cause 414
18fetch(`/api/search?${params.toString()}`); // DON'T DO THIS
19
20// Good: Use POST with body
21async function searchWithFilters(filters) {
22  const response = await fetch('/api/search', {
23  method: 'POST',
24    headers: {
25      'Content-Type': 'application/json',
26    },
27    body: JSON.stringify(filters), // Data in body, not URL
28  });
29  
30  if (response.status === 414) {
31    throw new Error('Request URL too long. Use POST instead of GET.');
32  }
33  
34  return response.json();
35}
36
37// For GET requests, limit query parameters
38function buildSearchUrl(base, params) {
39  const url = new URL(base);
40  
41  // Limit to first 20 parameters to keep URL short
42  const limitedParams = Object.entries(params).slice(0, 20);
43  
44  limitedParams.forEach(([key, value]) => {
45    if (Array.isArray(value)) {
46      // Limit array items
47      value.slice(0, 10).forEach(v => url.searchParams.append(key, v));
48    } else {
49      url.searchParams.append(key, String(value).substring(0, 100)); // Truncate long values
50    }
51  });
52  
53  // Check URL length
54  if (url.toString().length > 2000) {
55    throw new Error('URL too long. Use POST request with body instead.');
56  }
57  
58  return url.toString();
59}

1// Server-side: Accept both GET (short) and POST (long) for search
2const express = require('express');
3const app = express();
4
5app.use(express.json());
6
7// GET endpoint with limited query parameters
8app.get('/api/search', (req, res) => {
9  // Check URL length (Express doesn't enforce this by default)
10  const urlLength = req.url.length;
11  const maxUrlLength = 2000;
12  
13  if (urlLength > maxUrlLength) {
14    return res.status(414).json({
15      error: 'URI Too Long',
16      message: `Request URL (${urlLength} chars) exceeds maximum length (${maxUrlLength} chars). Use POST /api/search with body instead.`,
17      maxLength: maxUrlLength,
18      actualLength: urlLength,
19    });
20  }
21  
22  // Process search with query parameters
23  const results = performSearch(req.query);
24  res.json(results);
25});
26
27// POST endpoint for complex queries (no URL length limit)
28app.post('/api/search', (req, res) => {
29  // Complex filters in request body, no URL length concerns
30  const filters = req.body;
31  const results = performSearch(filters);
32  res.json(results);
33});
34
35// Alternative: Accept IDs in body for GET-like operations
36app.post('/api/resources/batch', (req, res) => {
37  // Instead of GET /api/resources?id=1&id=2&id=3... (long URL)
38  // Use POST /api/resources/batch with body: { ids: [1, 2, 3, ...] }
39  const { ids } = req.body;
40  
41  if (!Array.isArray(ids) || ids.length === 0) {
42    return res.status(400).json({ error: 'ids array required' });
43  }
44  
45  const resources = db.resources.findByIds(ids);
46  res.json(resources);
47});

1# Nginx: Configure buffers for longer URIs
2http {
3    # Increase buffer sizes for long URLs and headers
4    client_header_buffer_size 4k;
5    large_client_header_buffers 8 32k;  # 8 buffers of 32KB each (default is 4 8k)
6    
7    server {
8        listen 80;
9        server_name api.example.com;
10        
11        # Check URI length (optional, nginx handles this automatically)
12        # If URI exceeds large_client_header_buffers, returns 414
13        
14        location /api/search {
15            # For search endpoints, prefer POST
16            # But allow GET with reasonable limits
17            
18            proxy_pass http://backend;
19            proxy_set_header Host $host;
20            proxy_set_header X-Real-IP $remote_addr;
21            
22            # Pass full URI to backend
23            proxy_set_header X-Original-URI $request_uri;
24        }
25        
26        location /api/ {
27            proxy_pass http://backend;
28            proxy_set_header Host $host;
29            proxy_set_header X-Real-IP $remote_addr;
30        }
31    }
32    
33    # Custom error page for 414
34    error_page 414 /414.html;
35    location = /414.html {
36        return 414 '{"error":"URI Too Long","message":"Request URL exceeds maximum length. Use POST with request body instead."}';
37        default_type application/json;
38    }
39}