AOSSIE-Org / AOSSIE-Org/EduAid

[Enhancement] Add request payload size limits (MAX_CONTENT_LENGTH) to protect backend API endpoints

Offen
#564 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
enhancement
Vorherrschende Sprache
JavaScript
Sterne
171
Forks
425
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

### Feature and its Use Cases

## Feature Description

EduAid backend API endpoints currently accept JSON payloads containing text used for quiz generation and question answering. However, there is currently no restriction on the size of incoming request payloads.

Since these endpoints trigger transformer-based NLP models, very large inputs could lead to:

- excessive memory usage
- increased model inference time
- degraded performance for other users
- potential denial-of-service scenarios

Introducing request payload size limits would help protect the backend from extremely large requests before they reach the NLP pipeline.

---

## Potential Use Cases

For example, a client could send a request with an extremely large `input_text` payload (multiple MBs of text). Processing such inputs could:

- significantly increase CPU/GPU usage
- slow down quiz generation for other users
- exhaust backend resources

By enforcing a payload size limit, the API can safely reject overly large requests before expensive NLP processing begins.

---

## Example Scenario

If a request exceeds the allowed size (for example **2MB**), the backend could return a response like:

```json
{
"error": "Request payload too large",
"code": "payload_too_large"
}
```

---

### Additional Context

This enhancement complements other backend protection mechanisms already being introduced in EduAid such as:

- request rate limiting
- defensive input validation
- improved error handling

Adding request payload limits would further strengthen backend stability, especially for endpoints that trigger expensive NLP model inference.

---

### Possible Implementation

One simple approach is to configure Flask’s built-in request size limit:

```python
app.config["MAX_CONTENT_LENGTH"] = 2 * 1024 * 1024 # 2MB limit
```

---

### Code of Conduct

- [x] I have joined the [Discord server](https://discord.gg/hjUhu33uAn) and will post updates there
- [x] I have searched existing issues to avoid duplicates

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.