Hi everyone, I was directed here to discuss the maxLocaleCount default of 10 introduced in Tomcat 9.0.123 / 10.1.61 / 11.0.27
After upgrading, we started seeing legitimate users unable to use parts of our website. Their browsers send Accept-Language headers containing more than 10 language entries, which causes the following exception: java.lang.IllegalArgumentException: More than the maximum allowed number of locales, [10], were detected. Use the maxLocaleCount attribute of the connector to resolve this if the application should accept more locales. My main concern is that this behaviour change was introduced in a patch release. We expect routine patch upgrades to preserve compatibility unless a breaking change is necessary, for example to address a security vulnerability. Here, a new default caused previously accepted requests from users to fail, requiring an explicit configuration change to restore the previous behaviour. I understand the motivation for limiting resource consumption. However, as far as I understand, HTTP does not specify a maximum number of language entries in Accept-Language, and some of our users already exceed this default through their browser configuration. Why was 10 chosen as the default, and does disabling the limit pose a specific security risk despite the existing header size limit? Would you consider restoring the previous default in current release branches and introducing a stricter default in a major release? I have proposed changing the default to -1 in order to preserve compatibility and would appreciate your feedback. Thanks, Enric
