Re: [mod-security-users] Access denied with code 403. Error normalising REQUEST_URI: Invalid URL encoding detected: not enough characters

[Tom A. <tan...@oa...>]

Ivan Ristic wrote:
>   Thanks for pointing out the content of the "Location" header. You are right
>   in that the content is truncated but it's not ModSecurity or Apache that's
>   doing it. It is received that way so it's probably the client that is sending
>   it. There appears to be a limit of 432 bytes (imposed by the client).

All browsers impose maximum URL length requirements.  I believe Internet 
Explorer is 2048 characters.  Apache can handle something like 8k by 
default before returning a 414, though that is adjustable at compile 
time I think.  However, I recall that the rule of thumb is 255 
characters max on a GET due to certain other clients and proxies.  So 
try using a POST instead for anything over 255 characters.

Tom