dotnet / dotnet/aspnetcore

Add a middleware to enforce request size limits

Open
#40,452 5 comments 0 reactions 0 assignees View on GitHub
area-middleware area-networking Needs: Design
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 5h
Merged PRs (30d)
276

Description

A couple of limits are enforced by MVC filters. In addition, part of the Request Decompression middleware - https://github.com/dotnet/aspnetcore/issues/40080 limits specified by `RequestSizeLimitAttribute` are enforced for compressed requests if the middleware is present (e.g. `Content-Encoding: gz`), but not for regular requests.

The suggestion is to introduce a new middleware that can enforce request size limits. The middleware's primarily role is to configure existing HTTP features based on the presence of attributes on endpoints. In addition to this, we can have endpoint middleware enforce that the middleware was present if it detects endpoints with size limiting attributes.

* https://github.com/dotnet/aspnetcore/blob/main/src/Mvc/Mvc.Core/src/RequestSizeLimitAttribute.cs
* https://github.com/dotnet/aspnetcore/blob/main/src/Mvc/Mvc.Core/src/RequestFormLimitsAttribute.cs

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.