Description
HttpClientHandler
has a MaxResponseHeadersLength
property that controls how much data we'll buffer for the response headers before giving up.
The value is in KB, not bytes, so it's easy for users to set it way too high by mistake (e.g. #73848).
The default is 64 KB which should be plenty for the vast majority of use cases, but users sometimes choose to set it even lower.
I propose that we add an analyzer that warns the user if they set MaxResponseHeadersLength
to a constant higher than 128 (or 512 or 1024 - the exact number doesn't matter all that much).
In the rare case where the change was intentional, the user should suppress the warning.
new SocketsHttpHandler()
{
MaxResponseHeadersLength = 16 * 1024 // Do you really mean 16 MB?
};