Skip to content

Allow larger response headers when downloading tailwind - #142

Merged
SteffenDE merged 1 commit into
phoenixframework:mainfrom
georgeguimaraes:fix-max-header-size
Oct 23, 2026
Merged

SteffenDE merged 1 commit into
phoenixframework:mainfrom
georgeguimaraes:fix-max-header-size

Conversation

@georgeguimaraes

@georgeguimaraes georgeguimaraes commented Oct 23, 2026 •

Copy link
Copy Markdown
Contributor

mix tailwind.install fails on OTP 27 and later:

** (RuntimeError) Couldn't fetch https://github.com/tailwindlabs/tailwindcss/releases/download/v4.3.0/tailwindcss-linux-arm64: {true, {:error, {:header_too_long, {:max, 10240}}}}

GitHub's 302 redirect for a release download now sends about 10.8 KB of headers. Its content-security-policy header alone is about 9.2 KB. Since OTP 27, httpc limits the total response headers to max_header_size, which defaults to 10,240 bytes, so the request fails before the redirect is followed.

This change passes max_header_size: 32_768 with the request options. The redirect needs 10,784 bytes today, and the final download response needs 823. 32,768 gives about three times the current size, so a larger header does not break the download again, and it still caps a runaway response.

Checks:

  • mix test on elixir:1.18 (OTP 28, Linux): main fails with the error above, and this branch passes 8 of 8 tests.
  • mix format --check-formatted passes.
  • The request with the option returns the 302 on OTP 25, 26, 27, 28 and 29. Without it, OTP 27 and later return header_too_long. OTP 25 and 26 accept the option and work either way.

GitHub's release redirect now sends more than 10,240 bytes of headers, the
default max_header_size of httpc on OTP 27 and later, so the download fails
with {:header_too_long, {:max, 10240}}. Pass a larger max_header_size.
@mm503

mm503 commented Oct 23, 2026

Copy link
Copy Markdown

On OTP 29 and hitting this issue.. thanks @georgeguimaraes
@SteffenDE or @RobinBoers pretty please ❤️ this is a simple change to a serious pipeline-breaking issue.

@c9rgreen

Copy link
Copy Markdown

We are encountering this issue as well.

@SteffenDE
SteffenDE merged commit 900bf1d into phoenixframework:main Oct 23, 2026
2 checks passed
@SteffenDE

Copy link
Copy Markdown
Member

Thank you, released 0.5.2!

benwilson512 added a commit to CargoSense/dart_sass that referenced this pull request Oct 23, 2026
Closes #67.

`mix sass.install` fails on OTP 27 and later:

```
** (RuntimeError) couldn't fetch https://github.com/sass/dart-sass/releases/download/1.97.3/dart-sass-1.97.3-linux-arm64.tar.gz: {:error, {:header_too_long, {:max, 10240}}}
```

GitHub's 302 redirect for a release download now sends about 10.8 KB of
headers; its `content-security-policy` header alone is about 9.2 KB.
Since OTP 27, `:httpc` limits total response headers to the
`max_header_size` request option, 10,240 bytes by default, so the
request fails before the redirect can be followed. OTP 25 and 26 have no
limit (`nolimit` in `httpc_handler`) and ignore the option.

This passes `max_header_size: 32_768` with the request options in
`do_fetch/1`, the same change `phoenixframework/tailwind` shipped in
v0.5.2 ([#142](phoenixframework/tailwind#142)).
32 KiB is about three times today's redirect and still caps a runaway
response. The final download response from
`release-assets.githubusercontent.com` needs about 800 bytes.

**Checks** (Elixir 1.18.5, OTP 27.3, Linux arm64):

- `mix test` on `main`: fails in the `sass.install --if-missing` alias
with the error above.
- `mix test` on this branch: downloads 1.97.3 and passes every test,
including "updates on install", which downloads 1.74.1 and then 1.97.3
again.
- `mix format --check-formatted` passes.

Measurements behind the numbers are in #67.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants