MaxHeaderCountExceededException: Illegal attempt to exceed the configured maximum number of headers: 100 - security

Question

I'm required to force HTTPS in my web application so I did the following 2 thing in my web.xml configuration:
<security-constraint>
<web-resource-collection>
<web-resource-name>*</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<session-config>
<session-timeout>10</session-timeout>
<cookie-config>
<http-only>true</http-only>
<secure>true</secure>
</cookie-config>
<tracking-mode>COOKIE</tracking-mode>
</session-config>
When I deploy the webapp on glassfish 5 (which is the container where the webapp should run) I get a series of errors as if the application has entered into a loop during the servlet filters chain.
The exceptions I can identify are:
UPDATE the stack is the following
[glassfish 5.0] [SEVERE] [] [org.glassfish.grizzly.http2.Http2ServerFilter] [tid: _ThreadID=45 _ThreadName=http-listener-2(2)] [timeMillis: 1519314445367] [levelValue: 1000] [[
Unable to push resource identified by path [/demat/svz]]]
[glassfish 5.0] [SEVERE] [] [org.glassfish.grizzly.http2.Http2ServerFilter] [tid: _ThreadID=48 _ThreadName=http-listener-2(5)] [timeMillis: 1519314445367] [levelValue: 1000] [[
Unable to push resource identified by path [/demat/javax.faces.resource/core.js.jsf?ln=primefaces&v=6.1.2.NLC]]]
[glassfish 5.0] [SEVERE] [] [org.glassfish.grizzly.http2.Http2ServerFilter] [tid: _ThreadID=45 _ThreadName=http-listener-2(2)] [timeMillis: 1519314445367] [levelValue: 1000] [[
[glassfish 5.0] [SEVERE] [] [org.glassfish.grizzly.http2.Http2ServerFilter] [tid: _ThreadID=46 _ThreadName=http-listener-2(2)] [timeMillis: 1519144903315] [levelValue: 1000] [[
org.glassfish.grizzly.http2.Http2StreamException streamId=4474 errorCode=REFUSED_STREAM
at org.glassfish.grizzly.http2.Http2Session.openStream(Http2Session.java:1116)
at org.glassfish.grizzly.http2.Http2ServerFilter.doPush(Http2ServerFilter.java:994)
at org.glassfish.grizzly.http2.Http2ServerFilter.handleEvent(Http2ServerFilter.java:626)
at org.glassfish.grizzly.filterchain.ExecutorResolver$6.execute(ExecutorResolver.java:94)
at org.glassfish.grizzly.filterchain.DefaultFilterChain.executeFilter(DefaultFilterChain.java:284)
at org.glassfish.grizzly.filterchain.DefaultFilterChain.executeChainPart(DefaultFilterChain.java:201)
at org.glassfish.grizzly.filterchain.DefaultFilterChain.execute(DefaultFilterChain.java:133)
at org.glassfish.grizzly.filterchain.DefaultFilterChain.process(DefaultFilterChain.java:112)
at org.glassfish.grizzly.ProcessorExecutor.execute(ProcessorExecutor.java:77)
at org.glassfish.grizzly.filterchain.FilterChainContext.notifyDownstream(FilterChainContext.java:952)
at org.glassfish.grizzly.filterchain.FilterChainContext.notifyDownstream(FilterChainContext.java:934)
at org.apache.catalina.core.ApplicationPushBuilder.push(ApplicationPushBuilder.java:367)
at com.sun.faces.context.ExternalContextImpl.pushIfPossibleAndNecessary(ExternalContextImpl.java:704)
at com.sun.faces.context.ExternalContextImpl.encodeResourceURL(ExternalContextImpl.java:662)
at javax.faces.context.ExternalContextWrapper.encodeResourceURL(ExternalContextWrapper.java:164)
at com.sun.faces.renderkit.html_basic.ScriptStyleBaseRenderer.encodeEnd(ScriptStyleBaseRenderer.java:246)
at javax.faces.component.UIComponentBase.encodeEnd(UIComponentBase.java:949)
at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1912)
at com.sun.faces.renderkit.RenderKitUtils.renderJsfJsIfNecessary(RenderKitUtils.java:1203)
at com.sun.faces.renderkit.html_basic.CommandLinkRenderer.encodeBegin(CommandLinkRenderer.java:117)
at javax.faces.component.UIComponentBase.encodeBegin(UIComponentBase.java:892)
at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1903)
at javax.faces.render.Renderer.encodeChildren(Renderer.java:176)
at javax.faces.component.UIComponentBase.encodeChildren(UIComponentBase.java:918)
at com.sun.faces.renderkit.html_basic.HtmlBasicRenderer.encodeRecursive(HtmlBasicRenderer.java:309)
at com.sun.faces.renderkit.html_basic.GroupRenderer.encodeChildren(GroupRenderer.java:114)
at javax.faces.component.UIComponentBase.encodeChildren(UIComponentBase.java:918)
at com.sun.faces.renderkit.html_basic.HtmlBasicRenderer.encodeRecursive(HtmlBasicRenderer.java:309)
at com.sun.faces.renderkit.html_basic.GroupRenderer.encodeChildren(GroupRenderer.java:114)
at javax.faces.component.UIComponentBase.encodeChildren(UIComponentBase.java:918)
at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1905)
at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1908)
org.glassfish.grizzly.http.util.MimeHeaders$MaxHeaderCountExceededException: Illegal attempt to exceed the configured maximum number of headers: 100
at org.glassfish.grizzly.http.util.MimeHeaders.createHeader(MimeHeaders.java:466) ~[nucleus-grizzly-all.jar:?]
at org.glassfish.grizzly.http.util.MimeHeaders.addValue(MimeHeaders.java:507) ~[nucleus-grizzly-all.jar:?]
at org.apache.catalina.core.ApplicationPushBuilder.<init>(ApplicationPushBuilder.java:222) ~[web-core.jar:?]
at org.apache.catalina.connector.Request.newPushBuilder(Request.java:2609) ~[web-core.jar:?]
at org.apache.catalina.connector.RequestFacade.newPushBuilder(RequestFacade.java:1167) ~[web-core.jar:?]
at com.sun.faces.context.ExternalContextImpl.getPushBuilder(ExternalContextImpl.java:728) ~[javax.faces.jar:2.3.2]
at com.sun.faces.context.ExternalContextImpl.pushIfPossibleAndNecessary(ExternalContextImpl.java:701) ~[javax.faces.jar:2.3.2]
at com.sun.faces.context.ExternalContextImpl.encodeResourceURL(ExternalContextImpl.java:662) ~[javax.faces.jar:2.3.2]
at com.sun.faces.el.ResourceELResolver.getValue(ResourceELResolver.java:143) ~[javax.faces.jar:2.3.2]
at com.sun.faces.el.DemuxCompositeELResolver._getValue(DemuxCompositeELResolver.java:180) ~[javax.faces.jar:2.3.2]
at com.sun.faces.el.DemuxCompositeELResolver.getValue(DemuxCompositeELResolver.java:208) ~[javax.faces.jar:2.3.2]
at com.sun.el.parser.AstValue.getValue(AstValue.java:139) ~[javax.el.jar:3.0.1-b08]
at com.sun.el.parser.AstValue.getValue(AstValue.java:203) ~[javax.el.jar:3.0.1-b08]
at com.sun.el.ValueExpressionImpl.getValue(ValueExpressionImpl.java:226) ~[javax.el.jar:3.0.1-b08]
at org.jboss.weld.module.web.el.WeldValueExpression.getValue(WeldValueExpression.java:50) ~[weld-osgi-bundle.jar:3.0.0.Final]
at com.sun.faces.application.resource.ResourceHelper$ELEvaluatingInputStream.evaluateExpressionIntoBuffer(ResourceHelper.java:832) ~[javax.faces.jar:2.3.2]
at com.sun.faces.application.resource.ResourceHelper$ELEvaluatingInputStream.readExpressionIntoBufferAndEvaluateIntoBuffer(ResourceHelper.java:755) ~[javax.faces.jar:2.3.2]
at com.sun.faces.application.resource.ResourceHelper$ELEvaluatingInputStream.read(ResourceHelper.java:719) ~[javax.faces.jar:2.3.2]
at java.io.InputStream.read(InputStream.java:179) ~[?:1.8.0_121]
at java.io.BufferedInputStream.fill(BufferedInputStream.java:246) ~[?:1.8.0_121]
at java.io.BufferedInputStream.read1(BufferedInputStream.java:286) ~[?:1.8.0_121]
at java.io.BufferedInputStream.read(BufferedInputStream.java:345) ~[?:1.8.0_121]
at java.nio.channels.Channels$ReadableByteChannelImpl.read(Channels.java:385) ~[?:1.8.0_121]
at com.sun.faces.application.resource.ResourceHandlerImpl.handleResourceRequest(ResourceHandlerImpl.java:345) ~[javax.faces.jar:2.3.2]
at javax.faces.application.ResourceHandlerWrapper.handleResourceRequest(ResourceHandlerWrapper.java:178) ~[javax.faces.jar:2.3.2]
at org.primefaces.application.resource.PrimeResourceHandler.handleResourceRequest(PrimeResourceHandler.java:87) ~[primefaces-6.1.2.SIA.jar:?]
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:667) ~[javax.faces.jar:2.3.2]
at org.apache.catalina.core.StandardWrapper.service(StandardWrapper.java:1580) ~[web-core.jar:?]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:338) ~[web-core.jar:?]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) ~[web-core.jar:?]
at org.primefaces.webapp.filter.FileUploadFilter.doFilter(FileUploadFilter.java:100) ~[primefaces-6.1.2.SIA.jar:?]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:250) ~[web-core.jar:?]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) ~[web-core.jar:?]

Answer 1

Since JSF 2.3, CSS/JS resources will automatically be pushed to server when both server and client support HTTP/2 protocol and connection goes over SSL (HTTPS). You can clearly see this back in class and method names of this part of the stack trace:
at com.sun.faces.context.ExternalContextImpl.pushIfPossibleAndNecessary(ExternalContextImpl.java:704)
at com.sun.faces.context.ExternalContextImpl.encodeResourceURL(ExternalContextImpl.java:662)
at javax.faces.context.ExternalContextWrapper.encodeResourceURL(ExternalContextWrapper.java:164)
at com.sun.faces.renderkit.html_basic.ScriptStyleBaseRenderer.encodeEnd(ScriptStyleBaseRenderer.java:246)
However, in your specific case, the JSF page in question apparently has so many CSS/JS resources that it exceeds the server-configured limit of 100 response header entries.
org.glassfish.grizzly.http.util.MimeHeaders$MaxHeaderCountExceededException: Illegal attempt to exceed the configured maximum number of headers: 100
Given these facts, there are several solutions:
Decrease the amount of CSS/JS resources. Frankly, ~100 CSS/JS resources is insane. Consider combining them, if necessary with help of OmniFaces CombinedResourceHandler.
Configure GlassFish to allow more than 100 headers. This can be done via asadmin in commandline. Below is an example which increases it to 200 and assumes that the name of the HTTP listener being used is http-listener-1 (you can also find it in Admin console app).
set configs.config.server-config.network-config.protocols.protocol.http-listener-1.http.max-response-headers=200
Explicitly disable pushing CSS/JS resources by the below Mojarra-specific trick.
#FacesConfig
#ApplicationScoped
public class Config {
#Inject
private FacesContext context;
public void viewInitialized(#Observes #Initialized(ViewScoped.class) UIViewRoot view) {
context.getAttributes().put("com.sun.faces.ExternalContextImpl.PUSH_SUPPORTED", false);
}
}
This is indeed somewhat hacky, but that's because there's no explicit support for disabling this via e.g. a web.xml context parameter. Note that #FacesConfig is necessary in order to be able to #Inject the FacesContext, and that it suffices to have only one annotation of it application-wide. Otherwise you can still grab FacesContext#getCurrentInstance().

Answer 2

I solved it by disabling HTTP/2. For some reason, the number of resources pushed to the browser doesn't matter but for so long as I kept HTTP/2 enabled it was creating the above mentioned errors (those mentioned in the question).
To disable HTTP/2 execute the following command in asadmin:
> asadmin set server.network-config.protocols.protocol.http-listener-2.http.http2-enabled=false
Or in your domain.xml
<protocol name="http-listener-2" security-enabled="true">
<http http2-enabled="false" max-connections="250" compression="on" default-virtual-server="server">
<file-cache></file-cache>
</http>
<ssl classname="com.sun.enterprise.security.ssl.GlassfishSSLImpl" cert-nickname="s1as"></ssl>
</protocol>