Limiting API request size
Open
- Dominant language
- Go
- Stars
- 9.5k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
Didn't find any [config param](https://github.com/cloudflare/cfssl/blob/master/cli/config.go) nor hard-coded values to limit CFSSL's API request header and body sizes.
Consider configurable (better probably) or hard-coded limits for both elements (to prevent clients from accidentally or maliciously sending a large request and wasting server resources) using i.e.
- [MaxHeaderBytes](https://pkg.go.dev/net/http) for headers,
- `Content-Length` and [MaxBytesReader](https://pkg.go.dev/net/http#MaxBytesReader) for body.
Contributor guide
Assessment
This issue has not been assessed yet.