0.321.0

0.321.0

Release Date: November 18, 2024

Changes

• Add bosh properties for additional header (request and response) limits - #309, #443, cloudfoundry/gorouter#453 - Thanks @maxmoehl !
• Bump Go
• Bump dependancies

Bosh Job Spec changes:

diff --git a/jobs/gorouter/spec b/jobs/gorouter/spec
index c7896a27..cdebbd5a 100644
--- a/jobs/gorouter/spec
+++ b/jobs/gorouter/spec
@@ -266,12 +266,41 @@ properties:
       description: "Enforce strict validation of a route service signature"
       default: false
   router.max_header_kb:
+    description: |
+        Deprecated, use router.max_request_header_kb instead which is equivalent to this option.
+    default: 1024 # 1Mb
+  router.max_request_header_kb:
     description: |
         This value controls the maximum number of bytes (in KB) the gorouter will read
         parsing the request header's keys and values, including the request
         line. It does not limit the size of the request body. Requests with
         larger headers will result in a 431 status code. Must be between 1 and 1024kb.
-    default: 1024 # 1Mb
+        Note: This value takes precedence over router.max_header_kb but has no default to not break
+        existing setups. If you previously configured router.max_header_kb it is recommended to
+        switch to this property instead.
+    example: 1024 # 1Mb
+  router.max_response_header_kb:
+    description: |
+        This value controls the maximum number of bytes (in KB) the gorouter will read
+        parsing the response header's keys and values, including the request
+        line. It does not limit the size of the response body. Responses with
+        larger headers will result in a 502 status code. A limit of zero or less will
+        result in the default GoLang limit being used.
+    default: 0
+  router.max_request_headers:
+    description: |
+        This value controls the maximum number of headers gorouter will accept in a
+        single request. Only the header keys are counted and values separated by commas
+        are not considered additional headers. Setting this to zero or less disables the
+        limit. Must be at least 30 for CF to function properly (enforced).
+    default: 0
+  router.max_response_headers:
+    description: |
+        This value controls the maximum number of headers gorouter will accept in a
+        single response. Only the header keys are counted and values separated by commas
+        are not considered additional headers. Setting this to zero or less disables the
+        limit. Must be at least 30 for CF to function properly (enforced).
+    default: 0
   router.extra_headers_to_log:
     description: "An array of headers that access log events will be annotated with. This only applies to headers on requests."
     default: []

✨ Built with go 1.23.3

Full Changelog: v0.320.0...v0.321.0

Resources

• Download release 0.321.0 from bosh.io.