http-rs / http-rs/tide

Add body length limiting middleware

Open
#448 34 comments 3 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
5.1k
Forks
329
PR merge metrics
No merged PRs in 30d

Description

I was browsing the `warp` docs today and spotted the [`content_length` filter](https://docs.rs/warp/0.2.2/warp/filters/body/fn.content_length_limit.html). This allows setting limits on body payloads, which can be a DDOS vector. This would be neat to add to Tide as middleware.

## Example

I was thinking this could look something like this:
```rust
use tide::limit;

let mut app = tide::new();
app.at("/json").middleware(limit::content_len(1024 * 2)).post(|_| async {
Ok("req body len was less than 2kb")
});
```

Additionally a hierarchy of limits could be applied. For example we could say that for the whole app no body should ever be over 100mb. But then for specific routes we can set even lower limits. This seems like a practical solution for something that often tends to be an afterthought.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.