Long Combo URLs Exceeding 2048 Characters
Written By
Madhusudan Sharma
How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!
While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.
Legacy Article
You are viewing an article from our legacy "FastTrack"
publication program, made available for informational purposes. Articles
in this program were published without a requirement for independent
editing or verification and are provided"as is" without
guarantee.
Before using any information from this article, independently verify its
suitability for your situation and project.
Issue
- Long inbuilt Combo URLs exceeding 2048 characters are getting blocked at WAF level.
Resolution
- The long
/combo URLs are designed to intentionally be close to the maximum URL size, primarily for performance reasons.
- The source of the long URLs that start with "combo" is from the 'TopHeadDynamicInclude.java' class.
- If you would like to continue to pursue shortening the URL length, implementing customization may be the best option for moving forward.
- The primary place to look for customizing the long
/combo URLs is in the TopHeadDynamicInclude.java class. By default in core Liferay code (as defined in this file), new relative paths will be appended until the URL exceeds 2048 characters when it will then create a new src element for additional paths.
- Moreover, in the liferay-amd-loader, there is a URL length limit configuration setting within liferay-amd-loader, which defaults to 2000 (as you can see here).
- Additionally, these Combo URLs are being generated by the Liferay TopHeadDynamicInclude.java in the portal, which appends relative paths till they get over 2048 characters and then it creates a new src element. That is, when the URL exceeds 2048 characters it will stop concatenating and start creating a new "Combo URL", in which the URL which makes the URLs exceed 2048 characters is the last one being added to that "Combo URL". Because of this, most of them are going to have a length of around 2100 characters.
- Furthermore, these long URLs are neither a bug nor a product limitation but are within the industry standards which can be seen in the official specifications RFC7230. In section 2.5“HTTP does not have specific length limitations for many of its protocol elements because the lengths that might be appropriate will vary widely, depending on the deployment context and purpose of the implementation”
- The section 3.1.1 says that “HTTP does not place a predefined limit on the length of a request-line, as described in Section 2.5. A server that receives a method longer than any that it implements SHOULD respond with a 501 (Not Implemented) status code. A server that receives a request target longer than any URI it wishes to parse MUST respond with a 414 (URI Too Long) status code (see Section 6.5.12 of [RFC7231]).
Various ad hoc limitations on request-line length are found in practice. It is RECOMMENDED that all HTTP senders and recipients support, at a minimum, request-line lengths of 8000 octets.”
Did this article resolve your issue ?