diff --git a/etc/swift.conf-sample b/etc/swift.conf-sample
index 75501b3d17..18f649b047 100644
--- a/etc/swift.conf-sample
+++ b/etc/swift.conf-sample
@@ -1,9 +1,9 @@
 [swift-hash]
 
 # swift_hash_path_suffix and swift_hash_path_prefix are used as part of the
-# the hashing algorithm when determining data placement in the cluster. 
-# These values should remain secret and MUST NOT change 
-# once a cluster has been deployed. 
+# the hashing algorithm when determining data placement in the cluster.
+# These values should remain secret and MUST NOT change
+# once a cluster has been deployed.
 
 swift_hash_path_suffix = changeme
 swift_hash_path_prefix = changeme
@@ -48,6 +48,14 @@ swift_hash_path_prefix = changeme
 #max_meta_overall_size = 4096
 
 
+# max_header_size is the max number of bytes in the utf8 encoding of each
+# header. Using 8192 as default becasue eventlet use 8192 as max size of
+# header line and the longest header passed from Keystone(PKI token) uses
+# 8192 as default too.
+
+#max_header_size = 8192
+
+
 # max_object_name_length is the max number of bytes in the utf8 encoding
 # of an object name
 
diff --git a/test/unit/common/test_constraints.py b/test/unit/common/test_constraints.py
index ce786bb4f1..a16df5afae 100644
--- a/test/unit/common/test_constraints.py
+++ b/test/unit/common/test_constraints.py
@@ -210,5 +210,12 @@ class TestConstraints(unittest.TestCase):
         self.assertEquals(constraints.check_metadata(req, 'object').status_int,
                           HTTP_BAD_REQUEST)
 
+    def test_validate_constraints(self):
+        c = constraints
+        self.assertTrue(c.MAX_META_OVERALL_SIZE > c.MAX_META_NAME_LENGTH)
+        self.assertTrue(c.MAX_META_OVERALL_SIZE > c.MAX_META_VALUE_LENGTH)
+        self.assertTrue(c.MAX_HEADER_SIZE > c.MAX_META_NAME_LENGTH)
+        self.assertTrue(c.MAX_HEADER_SIZE > c.MAX_META_VALUE_LENGTH)
+
 if __name__ == '__main__':
     unittest.main()