fix(http): limit inbound request body size to 1MB - #4441
Open
stevenvegt wants to merge 2 commits into
Open
Conversation
Nothing capped inbound request bodies: the only body limits in the repository are outbound (http/client), so any caller could POST an arbitrarily large body to any endpoint on either interface. The deployment documentation also claimed the node limits request body sizes, which was not the case until now. Install echo's BodyLimit middleware on all interfaces, fixed at 1MB, returning 413 when exceeded. A deliberately heavy Verifiable Presentation (5 JWT credentials, each with an RSA-4096 x5c chain of 4 certificates) is around 133 kB, so 1MB leaves roughly 7x headroom, and matches the client_max_body_size the documentation recommends for reverse proxies. Assisted-by: AI
stevenvegt
requested review from
Dirklectisch,
JorisHeadease,
gerardsn,
reinkrul and
woutslakhorst
as code owners
July 30, 2026 15:02
Assisted-by: AI
Contributor
0 new issues
|
Contributor
|
Coverage Impact This PR will not change total coverage. Modified Files with Diff Coverage (1)
🛟 Help
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an inbound request body size limit of 1MB on both the public and internal interfaces, returning 413 (Request Entity Too Large) when exceeded. Until now nothing capped inbound bodies: the only body limits in the repository are outbound (
http/client), and the deployment documentation's claim that "the Nuts node will also limit the size of request bodies" was false. The documentation now states the actual limit.The limit is deliberately not configurable. The heaviest legitimate request is an OAuth POST carrying a Verifiable Presentation; a deliberately heavy case (5 JWT-encoded credentials, each with an RSA-4096
x5cchain of 4 certificates) computes to roughly 133 kB, and the two-VPjwt-bearerflow to roughly 260 kB, so 1MB keeps several times headroom over anything real. It also matches theclient_max_body_size 1Mthe deployment documentation already recommends configuring on a reverse proxy, so node and proxy guidance agree.Implementation: echo's
middleware.BodyLimitinstalled throughMultiEcho.Usewith the other global middleware inEngine.Configure, after the request logger so rejected requests still produce a request log entry.Testing: new
TestEngine_RequestBodyLimitasserts a 512 kB body is accepted (200), a 2 MB body is rejected with 413 on the public interface, and a 2 MB body is rejected with 413 on a route bound to the internal interface. Before the fix, both 2 MB requests returned 200.