Too big header x-device-info Topic is solved
Moderator: trava90
Forum rules
This board is for technical/general usage questions and troubleshooting for the Pale Moon browser only.
Technical issues and questions not related to the Pale Moon browser should be posted in other boards!
Please keep off-topic and general discussion out of this board, thank you!
This board is for technical/general usage questions and troubleshooting for the Pale Moon browser only.
Technical issues and questions not related to the Pale Moon browser should be posted in other boards!
Please keep off-topic and general discussion out of this board, thank you!
-
ksetmb
- Newbie
- Posts: 4
- Joined: 2025-08-22, 05:54
Too big header x-device-info
When I try to login on some site, I have 400 error "Size of a request header field exceeds server limit". In request x-device-info header have 10248 symbol. How can I block this? This problem only on Palemoon. My current version 33.8.1.2
-
ksetmb
- Newbie
- Posts: 4
- Joined: 2025-08-22, 05:54
Re: Too big header x-device-info
There is x-device-info header decoded value:
-
Moonchild
- Project founder
- Posts: 39119
- Joined: 2011-08-28, 17:27
- Location: Sweden
Re: Too big header x-device-info
Which site is this?
"There is no point in arguing with an idiot, because then you're both idiots." - Anonymous
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite
-
ksetmb
- Newbie
- Posts: 4
- Joined: 2025-08-22, 05:54
-
Moonchild
- Project founder
- Posts: 39119
- Joined: 2011-08-28, 17:27
- Location: Sweden
Re: Too big header x-device-info
Thanks.
I checked and this is webmaster error. They are enumerating whatever they can record of your browser (enumerating the entirety of window.navigator) and shoving it all (and more) into a header, which overflows the allowed space for HTTP header values on the receiving server end. So they are both requesting too much data, and then not allowing all that data to be received on the server end.
None of this should be collected at time of login, to begin with. In addition, they are stuffing authentication cookies into an unprotected http header as well (they are adding cookie information inside the x-device-info) which makes for the site to potentially be subject to replay attacks if intercepted. The "device info" header will contain and include login/account-specific data in addition to "device" data. This is super risky. If this "device info" ends up in a statistical database that isn't as-protected as account data then this is a breach waiting to happen. You were smart masking the auth cookie data yourself in your report here -- I never expected that to be part of device info, and it shouldn't be.
I'd complain to your bank about this. They need to only collect whatever device information they explicitly need for a browser check, and not include account-private data or other irrelevant data.
I checked and this is webmaster error. They are enumerating whatever they can record of your browser (enumerating the entirety of window.navigator) and shoving it all (and more) into a header, which overflows the allowed space for HTTP header values on the receiving server end. So they are both requesting too much data, and then not allowing all that data to be received on the server end.
None of this should be collected at time of login, to begin with. In addition, they are stuffing authentication cookies into an unprotected http header as well (they are adding cookie information inside the x-device-info) which makes for the site to potentially be subject to replay attacks if intercepted. The "device info" header will contain and include login/account-specific data in addition to "device" data. This is super risky. If this "device info" ends up in a statistical database that isn't as-protected as account data then this is a breach waiting to happen. You were smart masking the auth cookie data yourself in your report here -- I never expected that to be part of device info, and it shouldn't be.
I'd complain to your bank about this. They need to only collect whatever device information they explicitly need for a browser check, and not include account-private data or other irrelevant data.
Code: Select all
$.ajax({
type: 'POST',
url: '/REST/client4/afterLogin',
dataType: 'html',
data: {
login: login_v_elem.value,
passwd: passwd_v_elem.value,
fl: isFl ? '1' : null
},
beforeSend: function(xhr) { //сбор инфы
//сбор информации
try {
const navigatorObj = window.navigator;
let data = {
};
for (var property in navigatorObj) {
data[property] = navigatorObj[property];
}
data['client-ip'] = clientIp;
data['geolocation'] = clientGeo;
data['authCookie'] = authCookie;
xhr.setRequestHeader('x-auth-cookie', authCookie);
xhr.setRequestHeader('x-client-ip', clientIp);
xhr.setRequestHeader('x-device-info', window.btoa(JSON.stringify(data)));
xhr.setRequestHeader('x-fns-id', getCookie("fnsId"));
} catch (e) {
}
},"There is no point in arguing with an idiot, because then you're both idiots." - Anonymous
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite
-
ksetmb
- Newbie
- Posts: 4
- Joined: 2025-08-22, 05:54