haskell-servant / haskell-servant/servant
Unable to restrict the size of the request body that the server will accept
- Dominant language
- Haskell
- Stars
- 2k
- Forks
- 427
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 5
Description
I recently found that the amount of data that is accepted for a request body doesn't seem to be limited. I was able to upload a 1.6GB request body to the greet.hs example application, which seemed to be completely held in memory before the actual Handler was called and the request could be rejected. What's more, i can't seem to find any information on how to reject requests with large request bodies before they are completely transmitted.
There are a couple of things that i think should be present in servant, but since i don't know if i'm just unable to find the right knobs for what i want to do, and also am unfamiliar with the code base of the library itself, i wanted to ask before starting to hack some half-baked solution together:
1. A global sensible default limit should be imposed on request bodies. iirc yesod already does this.
2. A per route exception to that limit should be easy to make. As far as i understand this, for multipart uploads there's already some mechanism to implement limits via context.
3. Requests that exceed these limits should be dropped as soon as possible in order to not allow them to use up more system resources as necessary.
4. documentation obviously
I hope this sounds reasonable and that i didn't miss something obvious. I understand that this may be a significant amount of work to implement, and i'd be glad to help in any way i can if someone points me in the right direction.
Contributor guide
Assessment
This issue has not been assessed yet.