From c83e88348fbd473fb1de041cebabd3ace65d4d98 Mon Sep 17 00:00:00 2001 From: Paul Nothaft Date: Sun, 31 May 2026 22:35:19 +0200 Subject: [PATCH] fix(nginx): defensive large_client_header_buffers bump (#591) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Default nginx is 4 8k — too tight when an outer Cloudflare / corp-proxy injects long Set-Cookie / X-Forwarded-* headers, or when a power-user accumulates many per-gallery gallery_token_ cookies over the 24h maxAge in tokenUtils.js. Either way users hit "400 Request Header Or Cookie Too Large" and clearing cookies is the only workaround. 4×32k is cheap RAM, matches what most reverse proxies do upstream, and means PicPeak doesn't fail the request before the upstream even sees it. --- frontend/nginx.conf | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/frontend/nginx.conf b/frontend/nginx.conf index 9a16f008..1c8dc721 100644 --- a/frontend/nginx.conf +++ b/frontend/nginx.conf @@ -24,6 +24,15 @@ server { client_max_body_size 1G; client_body_timeout 300s; + # Defensive header buffer bump (#591). Default `4 8k` is too tight when + # an outer Cloudflare / corp-proxy sits in front and injects long + # Set-Cookie / X-Forwarded-* headers, or when a power-user accumulates + # many per-gallery `gallery_token_` cookies over the 24h maxAge + # in tokenUtils.js. Either way users hit "400 Request Header Or Cookie + # Too Large" and clearing cookies is the only fix. 4×32k is cheap RAM + # and matches what most reverse proxies already do upstream. + large_client_header_buffers 4 32k; + # Gzip compression gzip on; gzip_vary on;