CrowdHailer / raxx

Interface for HTTP webservers, frameworks and clients
https://hexdocs.pm/raxx
Apache License 2.0
401 stars 29 forks source link

Default Raxx.Server should have a limit on the maximum body it will build into a request #126

Closed CrowdHailer closed 5 years ago

CrowdHailer commented 5 years ago

Example App

defmodule MyApp do
  use Raxx.Server

  def handle_request(_request, _state) do
    response(:ok)
  end
end

When using just handle_request (not `handle_body etc) all the parts of the body are bundled in to the request, no matter how large the request is.

The code that does this is the default handle_body implementation. https://github.com/CrowdHailer/raxx/blob/master/lib/raxx/not_found.ex#L32-L35

This default implementation should stop buffering when it reaches max_body_length and return the appropriate response. The default max_body_length can be 8_000_000. The correct response is 413 Payload Too Large.

A first fix for this could have a hardcoded value, but ideally we would want it configurable as follows.

  use Raxx.Server, max_body_length: 10_000_000

checklist

CrowdHailer commented 5 years ago

On master, will be release in 0.16.0 Default max was set to 8MB