Squid Says Too Large: Was It the Headers or the Body?
Separate request and response header limits from body limits when a forward proxy rejects a transfer as too large.
A small download can exceed a header limit while a larger body succeeds. First identify which part of the exchange Squid rejected.
| Component | Matching Squid 5–7 directive |
|---|---|
| Client request headers, including the request line | request_header_max_size |
| Client request body, such as upload data | request_body_max_size |
| Server response headers | reply_header_max_size |
| Server response body | reply_body_max_size |
Use the actual proxy error and logs to identify the component and response issuer. An application limit or upstream rejection can look similar to a local Squid failure. Check the installed release's references for the matching threshold and default.
Also determine what Squid can see. Ordinary CONNECT does not expose the encrypted website headers inside an end-to-end TLS tunnel. Plaintext proxy requests, the CONNECT exchange itself and intercepted TLS can therefore involve different controls or components.
Before increasing the relevant limit, explain the unusual size. Repeated cookies, unexpected authentication data and malformed replies call for investigation; an intentionally supported large upload calls for a suitable body threshold. Raising every limit together hides that distinction.