Normally, such pieces of information as the maximum length of a URL are completely useless. The developers of HTTP server and client software take good care of such details, so that they do not interfere with the user’s browsing experience. Yesterday, while trying to create a CGI version of a script, I realized that the URL, which was produced by a GET HTTP request, was too lengthy, so I did some research about what is the maximum amount of characters a URL can contain.

It turned out that only Internet Explorer (up to version 7.0) has a limit. According to a document on Microsoft’s help and support site, IE may accept a URL of 2083 characters max. Moreover, the path (that is www.example.org/this/is/the/path) may have a length of 2048 characters. As far as other browsers are concerned (Firefox, Safari, Opera), they practically have no limits in the URL length. Web servers, however, do have such limits, but this is normal for a server.

The HTTP Protocol specification does not specify a maximum URL or path length, so the implementation of such limits is left to the developers of HTTP software.

The limits described above do not apply to POST HTTP requests. The data of such requests is completely contained into their body and not in the headers, therefore it is very unlikely that the Host header or the path exceed even Internet Explorer’s limits. Note that, if you do not use a HTML form or a high-level API to generate the POST request, it is required that you set the Content-Type header to be application/x-www-form-urlencoded. You can check HTTP headers using curl.

Below, you will find the headers and the body of an example POST request:

POST /cgi-bin/test.cgi HTTP/1.1
Host: www.example.org
Content-Type: application/x-www-form-urlencoded
Content-Length: 41
lastname=Smith&firstname=John&phone=12345

In Python, you can generate such a urlencoded body in the following way:

>>> param = { 'firstname':'John', 'lastname':'Smith', 'phone':'12345' }
>>> import urllib
>>> print urllib.urlencode(param)
lastname=Smith&firstname=John&phone=12345

This is exactly the same as generating the data of a GET request, but without any restrictions regarding the length, which is explicitly stated in the Content-Length header. Of course, you can use any programming language you like. This was just an example.

Related Articles

• HTTP headers
• HTTP Status Codes
• ModSecurity Overview

Tags: HTTP, Python, Specification