Description

Currently, apisix fetches request headers without limiting them, which could lead to security risks, and we could consider limiting them to the original default of 100.

I can file a PR to make this change.

ref:

• apisix/apisix/core/request.lua

  Lines 52 to 73 in c6b9f99

  	local function _headers(ctx)
  	if not ctx then
  	ctx = ngx.ctx.api_ctx
  	end
  	if not is_apisix_or then
  	return get_headers(0)
  	end
  	if a6_request.is_request_header_set() then
  	a6_request.clear_request_header()
  	ctx.headers = get_headers(0)
  	end
  	local headers = ctx.headers
  	if not headers then
  	headers = get_headers(0)
  	ctx.headers = headers
  	end
  	return headers
  	end

• https://github.com/openresty/lua-nginx-module#ngxreqget_headers