Maximum size of params object?

[Sitati Kituyi]

We have a bulk import feature in a Grails 2.4.3 app I'm working on, the last stage of which is a table where every cell has an input. We're submitting this all via a <g:form> tag (previous attempts to serialize large forms using jquery then submit with ajax caused some users' browsers to freeze up).

I've noticed that when the table is large enough to have more than 10,002 params, some data is missing from the params. I noticed this due to failed validation in some of the saved domains (due to missing required fields), then determined this maximum number by printing

params.keySet().size() // always 10,002

Just as a sanity check I created a Groovy map with 20k entries, so this isn't a language-level constraint. The params include controller and action, so it looks like it comes to a nice round 10k for user-defined params. Is this a known limit? If so, is it configurable?

Thanks,

Sitati

[Jeff Scott Brown]

It may depend on what container you are using. I think in Tomcat the org.apache.tomcat.util.http.Parameters.MAX_COUNT property helps dictate that. See https://docs.jboss.org/jbossweb/7.0.x/sysprops.html.

I hope that helps.



JSB

—
Jeff Scott Brown
Principal Software Engineer
Grails Development Team
Object Computing Inc.
http://www.ociweb.com/

Autism Strikes 1 in 166
Find The Cause ~ Find The Cure
http://www.autismspeaks.org/

[Sitati Kituyi]

Thanks for this Jeff.

This direction sounds promising, but I'm using Tomcat and changed the value in the Connector attribute of my server.xml. This didn't affect the 10k params limit. Furthermore, most references to the tomcat limit being hit suggest that a Tomcat exception is thrown (java.lang.IllegalStateException: Parameter count exceeded allowed maximum). In my case, it seems to silently fail, only keeping the first 10k params.

[Sitati Kituyi]

I managed to get to the bottom of this. You were right Jeff, it was Tomcat's maxParameterCount kicking in. The documentation that suggested an exception would be thrown was for JBoss; Tomcat will just silently ignore the x+1st param and every other after it.

The fix was to add our own value on the Connector attribute in Tomcat's server.xml

<Connector port="8080" protocol="HTTP/1.1" maxParameterCount="200000" connectionTimeout="20000" redirectPort="8443" />

When choosing a value for this, it is worth bearing in mind that one motivation for this limit is to mitigate DOS attacks: http://stackoverflow.com/a/12277296

Thanks again Jeff for pointing me in the right direction.