AOSSIE-Org / AOSSIE-Org/EduAid
[Enhancement] Add request payload size limits (MAX_CONTENT_LENGTH) to protect backend API endpoints
- 主要言語
- JavaScript
- スター
- 171
- フォーク
- 425
- PR マージ指標
- 30日以内にマージされた PR はありません
説明
### Feature and its Use Cases
## Feature Description
EduAid backend API endpoints currently accept JSON payloads containing text used for quiz generation and question answering. However, there is currently no restriction on the size of incoming request payloads.
Since these endpoints trigger transformer-based NLP models, very large inputs could lead to:
- excessive memory usage
- increased model inference time
- degraded performance for other users
- potential denial-of-service scenarios
Introducing request payload size limits would help protect the backend from extremely large requests before they reach the NLP pipeline.
---
## Potential Use Cases
For example, a client could send a request with an extremely large `input_text` payload (multiple MBs of text). Processing such inputs could:
- significantly increase CPU/GPU usage
- slow down quiz generation for other users
- exhaust backend resources
By enforcing a payload size limit, the API can safely reject overly large requests before expensive NLP processing begins.
---
## Example Scenario
If a request exceeds the allowed size (for example **2MB**), the backend could return a response like:
```json
{
"error": "Request payload too large",
"code": "payload_too_large"
}
```
---
### Additional Context
This enhancement complements other backend protection mechanisms already being introduced in EduAid such as:
- request rate limiting
- defensive input validation
- improved error handling
Adding request payload limits would further strengthen backend stability, especially for endpoints that trigger expensive NLP model inference.
---
### Possible Implementation
One simple approach is to configure Flask’s built-in request size limit:
```python
app.config["MAX_CONTENT_LENGTH"] = 2 * 1024 * 1024 # 2MB limit
```
---
### Code of Conduct
- [x] I have joined the [Discord server](https://discord.gg/hjUhu33uAn) and will post updates there
- [x] I have searched existing issues to avoid duplicates
コントリビューションガイド
このリポジトリのコントリビューションガイドは索引されていません
評価
この issue はまだ評価されていません。