Incorrect handling of long URLs [draft] about ingress-nginx

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[longwuyuan]

/remove-kind bug

• Why the word draft
• Did yo umean URLs that are over 1600 chars in length
• How does it work if you use plain old vanilla Nginx v1.25 as reverse-proxy instead of ingress-nginx

/kind support
/triage needs-information

[phantom943]

Hello @longwuyuan !

• The word draft just because I haven't finished filling in all the details (like how was the controller installed and whatnot). I am still finishing getting details from my colleagues
• Yep, correct. URLs over 1600 chars in length
• I am not sure if we can do that. I'll try, but that requires a lot of setup at this point.

[longwuyuan]

ok. can you also describe why your URL is so long.

[phantom943]

@longwuyuan well, it's a very bad choice by the end app developers - they are passing an OpenID token via a URL parameter -.-
Can't do much about that though

[longwuyuan]

ok, thank you for the info. explains the use case

[longwuyuan]

i am checking the nginx specs and HTTP specs. Maybe you can do the same. This project code will not set that limit for sure.

cc @tao12345666333 @rikatz if you already know the spec limit for a HTTP len(URL)

[longwuyuan]

If you already have the complete error message from the controller logs, please copy/paste it here

[longwuyuan]

If it is this

https://www.slingacademy.com/article/nginx-error-414-request-uri-too-large-causes-and-solutions/

then the recommended solution is this

https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#large-client-header-buffers

[longwuyuan]

Also controller v1.1.1 is not supported anymore. Is that the real version of hte controller in use ?

[phantom943]

Hey @longwuyuan
thanks a lot for your suggestions!
We have indeed tried large-client-header-buffers, to no avail.
We have also just updated to the latest version of controller (v1.10.0), also with no effect - the bug still
I don't believe it's a matter of a setting, because otherwise it would have reproduced 100% of the time, not 30%.
Also interesting think to note is that this seems to be dependent on the application - I have another application where if I put a long token into the URL and just return it as a response, no 505 errors occur. So it could be a combination of a bug in the application and a bug in the ingress controller itself.
Do you have any suggestions on how to debug this maybe?

[longwuyuan]

• if you can run one request with 1800 chars in the URL and it does not fail, then I agree that this is not related to the large-client-header-buffer

• I would next find a threshold at which the success rate begins to drop below 100%. Like use load generation tools and send incremental volumes but in batches.

  • 10 requests with 1800 chars in URL
  • 100 ditto
  • 500 ditto
  • and so on

[longwuyuan]

Also, still waiting on the exact and real complete error message lines