resgateio / resgate

A Realtime API Gateway used with NATS to build REST, real time, and RPC APIs, where all your clients are synchronized seamlessly.
https://resgate.io
MIT License
689 stars 67 forks source link

Maximum control line size validation #185

Closed jirenius closed 3 years ago

jirenius commented 3 years ago

Issue

Using long resource IDs or method names (for call or auth requests) may cause the NATS subject to exceed the maximum control line size, which in turn will disconnect Resgate from NATS.

This affects both requests through WebSocket as well as HTTP.

Solution

Add validation for the generated request subject + reply inbox subject to make sure the sum doesn't exceed NATS' default MAXIMUM_CONTROL_LINE_SIZE which is set to 4096 bytes. If it does, no NATS request should be made, and an error should be returned:

{ "code": "system.subjectTooLong", "message": "Subject too long" }

In case of HTTP requests, the status code would be:

414 URI Too Long

Note

jirenius commented 3 years ago

Resolved in #186