-
Notifications
You must be signed in to change notification settings - Fork 462
Closed
Labels
Description
This ticket describes one of the tasks of #2971
We want to extend our Netty-based servers to support checking for maxContentLength in requests on multiple levels. The implementation should prevent loading excessive bytes into memory:
- Globally - as currently available in
NettyConfig.maxContentLength.
- Current implementation for non-streaming servers uses
HttpObjectAggregatorwhich takes this as a parameter. - The Cats Effect implementation has a different pipeline, using
HttpStreamsServerHandlerto produce reactivePublisher, which gets converted to a fs2.Stream inNettyCatsRequestBody. Here we should add a custom fs2 stage in thetoStream()method; this stage would fail the stream if max content length is exceeded. - The ZIO implementation is currently non-streaming, but ultimately it should become similar to the Cats Effect one, with a similar solution.
- Per-endpoint - this can be carried by an endpoint attribute, which could be translated by the server interpreter to a
ServerRequestattribute.
- The Future-based server would need to stop using
HttpObjectAggegatorand switch toHttpStreamsServerHandler, just like for the streaming servers (CE/ZIO). Then, itsNettyRequestBodyimplementation would need to handle streams instead ofByteBuf. Otherwise it would be too late to prevent loading bytes into memory, which happens inHttpObjectAggregator. The new implementation ofNettyRequestBodywould need to handle aPublisher, using a customSubscriber(see SimpleSubscriber in sttp for example). This subscriber would be responsible for pulling all the bytes and emitting a final byte array or fail in case of exceeded limit.
It would be great to be able errors properly, by emitting a HTTP 413 Entity Too Large response.
adamw