Issue 56 - Add limit to size of headers

[kolbma]

Hello,
I think it is required to not handle http headers and header fields of any size the clients might provide. (DOS, OOM)
This PR limits the header body to 8192 bytes and the header lines to 2048 bytes. Popular servers (apache, nginx) have similar restrictions.

When a client is going over the limits the HTTP status 431 Request Header Fields Too Large is returned.

I've seen that it has been already the intention in #56 to implement this.
I hope this PR is welcome.

[Kijewski]

IMHO 8192 bytes in total is much too small. If the browser is configured to send the full URL in the Referer header, then you could not send a single cookie if the base URL is quite long.

Apaches defaults are:

• LimitRequestFields = the number of HTTP request header fields that will be accepted from the client = 100
• LimitRequestFieldSize = the size of the HTTP request header allowed from the client = 8190
• LimitRequestLine = the size of the HTTP request line that will be accepted from the client = 8190
• Total size header of headers = unlimited (or implicitly: LimitRequestFields * LimitRequestFieldSize)

[bradfier]

I have to agree with @Kijewski here, I've seen no end of questionably designed applications that include kilobytes of payload in either query parameters or really long path-style URLs (cough WebSphere).

Using Apache's default values here works for me, but we do need to consider this a breaking change and gate it behind a .with_default_header_limits() on ServerConfig. I appreciate this makes the change much bigger.

[kolbma]

@Kijewski @bradfier Don't you develop the "questionable" application with tiny-http itself and therefor why you want to develop a bad kind of WebSphere JEE app with tiny-http where you possible have base urls with thousands of characters and same for cookies?
Not sure why you think you have to handle unknown/all applications in tiny-http and don't handle the currently for every app existing security problem in soon 3 months.