cloudflare / cloudflare/cfssl

Limiting API request size

Open
#1,328 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
9.5k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

Didn't find any [config param](https://github.com/cloudflare/cfssl/blob/master/cli/config.go) nor hard-coded values to limit CFSSL's API request header and body sizes.

Consider configurable (better probably) or hard-coded limits for both elements (to prevent clients from accidentally or maliciously sending a large request and wasting server resources) using i.e.

- [MaxHeaderBytes](https://pkg.go.dev/net/http) for headers,
- `Content-Length` and [MaxBytesReader](https://pkg.go.dev/net/http#MaxBytesReader) for body.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.