@@ -9,6 +9,14 @@ import (
99"github.com/coder/coder/v2/coderd/rbac"
1010)
1111
12+ // The x-authz-checks header can end up being >10KB in size on certain queries.
13+ // Many HTTP clients will fail if a header or the response head as a whole is
14+ // too long to prevent malicious responses from consuming all of the client's
15+ // memory. I've seen reports that browsers have this limit as low as 4KB for the
16+ // entire response head, so we limit this header to a little less than 2KB,
17+ // ensuring there's still plenty of room for the usual smaller headers.
18+ const maxHeaderLength = 2000
19+
1220// This is defined separately in slim builds to avoid importing the rbac
1321// package, which is a large dependency.
1422func SetAuthzCheckRecorderHeader (ctx context.Context ,rw http.ResponseWriter ) {
@@ -23,6 +31,11 @@ func SetAuthzCheckRecorderHeader(ctx context.Context, rw http.ResponseWriter) {
2331// configured on server startup for development and testing builds.
2432// - If this header is missing from a response, make sure the response is
2533// being written by calling `httpapi.Write`!
26- rw .Header ().Set ("x-authz-checks" ,rec .String ())
34+ checks := rec .String ()
35+ if len (checks )> maxHeaderLength {
36+ checks = checks [:maxHeaderLength ]
37+ checks += "<truncated>"
38+ }
39+ rw .Header ().Set ("x-authz-checks" ,checks )
2740}
2841}