Allow a larger value for the REST source custom header (--header, currently limited to 1024 characters) #6633

Relevant area(s)

WinGet CLI

Description of the new feature / enhancement

The --header option sends its value as the Windows-Package-Manager header on every request to a REST source. The client rejects any value longer than 1024 characters with 0x8A150047 (APPINSTALLER_CLI_ERROR_CUSTOMHEADER_EXCEEDS_MAXLENGTH, "Header size exceeds the allowable limit of 1024 characters"). The limit is WindowsPackageManagerHeaderMaxLength in RestClient.cpp. The REST API spec in winget-cli-restsource also declares maxLength: 1024 for the header.

My scenario: a managed REST source that authenticates each device with a signed token. The header is the only supported way to give a REST source per-device credentials (#893, #3428). A token that carries an X.509 certificate and a signature easily exceeds 1024 characters. I can keep tokens under the limit, but only by dropping security properties, such as a self-contained certificate chain, or by moving trust to extra server-side lookups.

I could not find a documented reason for the 1024-character limit. Is there a technical constraint behind it?

Proposed technical implementation details

Any of these would solve it:

1. Raise the limit, for example to 4096 or 8192 characters. Update the REST API spec (new API version or spec amendment) and the client constant.
2. Support client-certificate or token-based authentication for REST sources natively (see Certificate based authentication for REST sources. #1919), so that credentials do not have to be passed through a custom header.