dotnet / dotnet/aspnetcore

[Blazor] Relax size limits on Server sourced payloads

Open
#63,693 0 comments 2 reactions 0 assignees View on GitHub
area-blazor
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

* Currently Blazor Server has a hard limit based on the SignalR message size, as all payloads are required to fit in there, which is present for security reasons.
* For some framework specific payloads that are generated within the server, we don't have to rely on the SignalR message size and can instead chunk larger payloads into multiple "chained" links that then we reconstruct on the server before processing.
* The main requirement for these "chained" payloads is that the server must be responsible for generating them and that we need to require clients sending all the parts in a given amount of time to avoid incurring in trickle attacks.
* The idea here is to generate a list of "blocks" that we "chain" via a "sequence number" and that we require the client to deliver in the same order and at a given minimum rate.
* We could extend this system to support certain "untrusted" inputs by requiring the consumer (the server) to specify an explicit limit.

This would cover issues like:
* https://github.com/dotnet/aspnetcore/issues/51080
* https://github.com/dotnet/aspnetcore/issues/50874
* https://github.com/dotnet/aspnetcore/issues/63690

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.