-
-
Notifications
You must be signed in to change notification settings - Fork 892
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add LimitBodySizeMiddleware
#2350
Conversation
Can user set a low body size globally and enlarge it per route? It seems to me that app-level middleware returns 413 response as fast as limit reached. Starlette(
middleware=[
Middleware(LimitRequestMiddleware, max_body_size=1024) # 1024b globally
],
routes=[
Route('/'), # it's ok to use a global limit here
Route('/upload', middleware=[
Middleware(LimitRequestMiddleware, max_body_size=1024 ** 3 ), # i want a greater limit here
])
],
) |
Yes. That should be possible. I'm going to add a test for it. |
I think that to make have to split it into two middlewares and pass the max size around in the scope like #2175 does |
Ah sorry, I thought you meant to increase the constraint, not to relax it. I don't think we should allow that. One could always mount the applications as they want. |
I disagree and I think @alex-oleshkevich will as well. Small limits by default and larger limits on certain endpoints seems like a very important use case. |
I've complied with this. |
I feel like this middleware will give the false impression of security. The moment the application calls
I think a more correct approach would be to restrict this from the server side, and allow customizing per path e.g.: |
IMO servers should (and do?) stream data and not buffer it for too long. So server is also not aware of the payload size until EOF. |
I agree this. Add limit body size config in uvicorn/nginx is better. |
After a lot of thinking, I don't think Starlette should have this level of granularity on those limits. I can be convinced on the global level, but not on per endpoint basis. Besides, there's no record of a popular web framework doing this per basis (unless you can prove me wrong?). We can document that any ASGI web server (Uvicorn and Gunicorn) has global limits set by default. Also, I do believe it's a nice contribution to have this middleware implemented as a third party. @adriangb Since the last commit is pretty much your implementation, do you mind if I create this package, or do you want to create it yourself? |
Q&A
Because the chunks the application receive are not the chunks the server is receiving from the client.