search

erlyaws / yaws

Yaws webserver
https://erlyaws.github.io
BSD 3-Clause "New" or "Revised" License
1.28k stars 267 forks source link

partial_post_size=nolimit is dangerous? #391

Closed MayamaTakeshi closed 4 years ago

MayamaTakeshi commented 4 years ago

Hi, regarding partial_post_size, the doc says "Setting it to nolimit is potentially dangerous." What kind of danger would this be?

Would it be some sort of security issue? I am asking because I want to use nolimit but since this would be for a non-public server, I don't have security concerns.

vinoski commented 4 years ago

The danger here is that a client could post a very large part, so large that the web server process runs out of memory and crashes. It sounds like in your environment, clients are likely to be well behaved, and so using nolimit likely won't be a problem for you.

MayamaTakeshi commented 4 years ago

Understood. So it will be OK for me to use nolimit. Thanks.