URL最大長度限制

在開發調試支付寶接口時，忽然發現支付寶接口的URL很長，遠遠大於以前本身印象中的255個字符。趕忙搜索查證了一番，理解以下：

1. URL不能大於255bytes的說法確實存在，在RFC2616中提到：

   The HTTP protocol does not place any a priori limit on the length of a URI. Servers MUST be able to handle the URI of any resource they serve, and SHOULD be able to handle URIs of unbounded length if they provide GET-based forms that could generate such URIs. A server SHOULD return 414 (Request-URI Too Long) status if a URI is longer than the server can handle (see section 10.4.15).

   Note: Servers ought to be cautious about depending on URI lengths above 255 bytes, because some older client or proxy implementations might not properly support these lengths.

2. 從上一點也能夠看出，255bytes的說法也是爲了兼容性考慮。實際上現代瀏覽器的限制以下：

   Microsoft Internet Explorer (Browser)
   Microsoft states that the maximum length of a URL in Internet Explorer is 2,083 characters, with no more than 2,048 characters in the path portion of the URL. In my tests, attempts to use URLs longer than this produced a clear error message in Internet Explorer.
   Firefox (Browser)
   After 65,536 characters, the location bar no longer displays the URL in Windows Firefox 1.5.x. However, longer URLs will work. I stopped testing after 100,000 characters.
   Safari (Browser)
   At least 80,000 characters will work. I stopped testing after 80,000 characters.
   Opera (Browser)
   At least 190,000 characters will work. I stopped testing after 190,000 characters. Opera 9 for Windows continued to display a fully editable, copyable and pasteable URL in the location bar even at 190,000 characters.
   Apache (Server)
   My early attempts to measure the maximum URL length in web browsers bumped into a server URL length limit of approximately 4,000 characters, after which Apache produces a 「413 Entity Too Large」 error. I used the current up to date Apache build found in Red Hat Enterprise Linux 4. The official Apache documentation only mentions an 8,192-byte limit on an individual field in a request.
   Microsoft Internet Information Server
   The default limit is 16,384 characters (yes, Microsoft’s web server accepts longer URLs than Microsoft’s web browser). This is configurable.
   Perl HTTP::Daemon (Server)
   Up to 8,000 bytes will work. Those constructing web application servers with Perl’s HTTP::Daemon module will encounter a 16,384 byte limit on the combined size of all HTTP request headers. This does not include POST-method form data, file uploads, etc., but it does include the URL. In practice this resulted in a 413 error when a URL was significantly longer than 8,000 characters. This limitation can be easily removed. Look for all occurrences of 16×1024 in Daemon.pm and replace them with a larger value. Of course, this does increase your exposure to denial of service attacks.

3. 另外值得注意的是，有文章提到做爲<a>的href屬性時，URL不能超過1024bytes，這點沒有詳細查證

綜上，URL仍是不適合太長，不是不得已，儘可能不要經過GET方式提交大量參數，能夠考慮用POST方式（大約在2M左右，應該是和服務器及設定有關）。另外這麼長的URL在訪問和收藏（有文章提到有些瀏覽器在收藏超長地址時也是會出現問題）時也是至關不友好的。固然，以前數據庫字段設置時仍是做爲255bytes處理，如今可能要考慮擴充一下了。

參考：

1. What is the maximum length of a URL?
2. What is the limit on QueryString / GET / URL parameters?
3. 文章摘自：http://blog.csdn.net/jinhill/article/details/3961881