I want to increase the maximum number of HTTP parameters (maxParameterCount) from 10000 to 20000 in the Tomcat configuration: https://tomcat.apache.org/tomcat-8.5-doc/config/http.html

What is the security risks of increasing the maximum number of HTTP parameters?

  • 1
    If you need that many parameters, you are certainly not handling html forms with human input. Instead of gazillions of parameters, I'd think about uploading a single structured (e.g. XML) file – Hagen von Eitzen Jun 3 '18 at 21:28

As someone said in a comment, this reeks of bad design.

Anyway, in the past there have been denial of service attacks against server software done by using many parameters that share the same hash as used by the hashing function in the server to convert the parameter list to a dictionary/hashmap. These hash collisions would lead to a wildly increased load in bad server software (that was, most prominent example of that category, the PHP interpreter).

That problem can be mitigated by using an unknown salt for that hash function, so that the attacker can't predict which parameters would lead to a hash collision.

With that many parameters, however, chances are that you generate hash collisions if you just pick random parameter names.

Anyway, the assumption that someone would still be able to DOS a server with that is purely hypothetic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.