search

Stiffstream / restinio

Cross-platform, efficient, customizable, and robust asynchronous HTTP(S)/WebSocket server C++ library with the right balance between performance and ease of use
Other
1.16k stars 92 forks source link

Streaming Request Body #14

Open webfolderio opened 5 years ago

webfolderio commented 5 years ago

Hi,

From the Restinio doc.:

Request handler

Body can be accesed by request_t::body() function which returns a reference to std::string.

Why do you preferred std::string instead of a suitable stream type? I couldn't figure out what happen if http client sends request body which does not fit in the memory?

eao197 commented 5 years ago

Hi!

The main use case for RESTinio was (and I suppose still is): take a get/post request, post it for async processing to some another work thread, take a result and send the result back. In our scenarios all requests had some reasonable size.

webfolderio commented 5 years ago

Thanks for the clarification.

My main concern is to buffer attacks. consume_data(const char *, std::size_t) did not prevent vulnerability to buffer attacks. I know that there is a timeout setting that rejects long requests but it might be still good idea to an optional setting to limit request body size.

eao197 commented 5 years ago

but it might be still good idea to an optional setting to limit request body size.

I think you're right -- it looks like a good idea. We'll try to address this in the next update for RESTinio. But it hard to predict when this update will be released because we are busy on other projects now and the next free timeslot will be only after a week or two from now :(