Netlify rejects all requests with User-Agent headers longer than 512 characters

As stated in the title, Netlify rejects all requests with User-Agent headers longer than 512 characters with an HTTP 400 response, “User-Agent is too long”. A curl command for reproduction:

$ curl -A 'Mozilla/5.0 (iPhone; CPU iPhone OS 15_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) AdditionalInfo1/093ab8d6b6305af5c9b6fa1485622254 AdditionalInfo2/a8cd967820d1c215d69e1eda22e693e4 AdditionalInfo3/1d11752c057c4a4346f11147dcf8e31c AdditionalInfo4/7f73ba9b543477fb493e48ad8e71b3ef AdditionalInfo5/9434fc5cf4b9bf828076b8e404bf6c5f AdditionalInfo6/01bf2cdf9e03276767084b8fd5d394c6 AdditionalInfo7/d77ccef4c44c559f9d80b45b3d0c5feb AdditionalInfo8/242cc8cb2328ac0754ebbbfc9de10a74 AdditionalInfo9/56b6645b57e2fd508db8e84078ed8641' -D - https://lodash.netlify.app/
HTTP/1.1 200 Connection established

HTTP/2 400
x-nf-request-id: <redacted>
server: Netlify
date: Fri, 18 Feb 2022 08:50:41 GMT
content-length: 22

User-Agent is too long

This is not really reasonable behavior; none of the major web servers do this out of the box, and alternatives/competitors like Vercel, Cloudflare Pages, GitHub Pages, etc. don’t have this restriction from my testing.


Background & details

Some users told me they simply get a “User-Agent is too long” page when trying to open my Netlify site in the iOS Douyin app (the Chinese version of TikTok, which is very popular). I looked into the issue and apparently their webview sends a really long User-Agent header — about 540 bytes, including locale, region, app theme, etc. in it. This is a bit on the weird side but not against any spec as far as I can tell, and ~540 bytes is long but not outrageously long, far from the default header length limit on any major web server. However, apparently Netlify rejects all such requests, so I’m afraid I’ll have to move to another hosting provider. Maybe this limitation isn’t intentional?

Hey @km2,

At this point, this doesn’t seem to be a configurable value and it’s in place intentionally. We can ask the engineers if it’s up for discussion, but this has not been requested in the past, so chances are this would not change.